medium5.0Public exploit code
CVE-2014-8995
SQL injection vulnerability in Maarch LetterBox 2.8 allows remote attackers to execute arbitrary SQL commands via the UserId cookie.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Maarch LetterBox 2.8 - (Authentication Bypass) Insecure Cookies2014-11-17 · webapps · php
Impact
SQL injection vulnerability in Maarch LetterBox 2.8 allows remote attackers to execute arbitrary SQL commands via the UserId cookie.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Maarch | Letterbox | Version 2.8 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/129135/Maarch-LetterBox-2.8-Insecure-Cookie-Handling.html
- http://www.osvdb.org/114772
- https://exchange.xforce.ibmcloud.com/vulnerabilities/98775
- http://packetstormsecurity.com/files/129135/Maarch-LetterBox-2.8-Insecure-Cookie-Handling.html
- http://www.osvdb.org/114772
- https://exchange.xforce.ibmcloud.com/vulnerabilities/98775