medium6.5Public exploit code
CVE-2014-6030
Multiple SQL injection vulnerabilities in ClassApps SelectSurvey.NET before 4.125.002 allow (1) remote attackers to execute arbitrary SQL commands via the Surv…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- ClassApps SelectSurvey.net - Multiple SQL Injections2014-09-20 · webapps · php
Impact
Multiple SQL injection vulnerabilities in ClassApps SelectSurvey.NET before 4.125.002 allow (1) remote attackers to execute arbitrary SQL commands via the SurveyID parameter to survey/ReviewReadOnlySurvey.aspx or (2) remote authenticated users to execute arbitrary SQL commands via the SurveyID parameter to survey/UploadImagePopupToDb.aspx.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Classapps | Selectsurvey.Net | through 4.125.001 Version 4.125.000 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/128296/ClassApps-SelectSurvey.net-4.124.004-SQL-Injection.html
- http://seclists.org/fulldisclosure/2014/Sep/62
- http://packetstormsecurity.com/files/128296/ClassApps-SelectSurvey.net-4.124.004-SQL-Injection.html
- http://seclists.org/fulldisclosure/2014/Sep/62