high7.5Public exploit code
CVE-2014-5082
Multiple SQL injection vulnerabilities in admin/admin.php in Sphider 1.3.6 and earlier, Sphider Pro, and Sphider-plus allow remote attackers to execute arbitra…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Sphider Search Engine 1.3.6 - Multiple Vulnerabilities2014-07-28 · webapps · php · Verified
- Sphider Search Engine - Multiple Vulnerabilities2014-08-02 · webapps · php
Impact
Multiple SQL injection vulnerabilities in admin/admin.php in Sphider 1.3.6 and earlier, Sphider Pro, and Sphider-plus allow remote attackers to execute arbitrary SQL commands via the (1) site_id or (2) url parameter.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Sphider | Sphider | through 1.3.6 Versions 1.3.2, 1.3.3, 1.3.4, 1.3.5 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/127720/Sphider-Search-Engine-Command-Execution-SQL-Injection.html
- http://www.exploit-db.com/exploits/34189
- http://packetstormsecurity.com/files/127720/Sphider-Search-Engine-Command-Execution-SQL-Injection.html
- http://www.exploit-db.com/exploits/34189