high8.8Public exploit code
CVE-2014-3119
Multiple SQL injection vulnerabilities in web2Project 3.1 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) search_str…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- web2Project 3.1 - Multiple Vulnerabilities2014-06-19 · webapps · php
Impact
Multiple SQL injection vulnerabilities in web2Project 3.1 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) search_string parameter in the contacts module to index.php or allow remote attackers to execute arbitrary SQL commands via the updatekey parameter to (2) do_updatecontact.php or (3) updatecontact.php.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Web2project | Web2project | through 3.1 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/web2project/web2project/commit/ab5ba92a6aaf0435cd0b2132cf7f9b7b41575a28
- https://github.com/web2project/web2project/commit/eead99b36f62a8222d9f3a913f1a2268200687ef
- https://www.htbridge.com/advisory/HTB23213
- https://github.com/web2project/web2project/commit/ab5ba92a6aaf0435cd0b2132cf7f9b7b41575a28
- https://github.com/web2project/web2project/commit/eead99b36f62a8222d9f3a913f1a2268200687ef
- https://www.htbridge.com/advisory/HTB23213