high7.5Public exploit code
CVE-2014-9237
SQL injection vulnerability in Proticaret E-Commerce 3.0 allows remote attackers to execute arbitrary SQL commands via a tem:Code element in a SOAP request.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Proticaret E-Commerce Script 3.0 - SQL Injection (2)2014-11-17 · webapps · xml
- Proticaret E-Commerce Script 3.0 - SQL Injection (1)2014-11-13 · webapps · multiple
Impact
SQL injection vulnerability in Proticaret E-Commerce 3.0 allows remote attackers to execute arbitrary SQL commands via a tem:Code element in a SOAP request.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Proticaret | Proticaret | Version 3.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/129129/Proticaret-E-Commerce-Script-3.0-SQL-Injection.html
- http://seclists.org/fulldisclosure/2014/Nov/43
- http://packetstormsecurity.com/files/129129/Proticaret-E-Commerce-Script-3.0-SQL-Injection.html
- http://seclists.org/fulldisclosure/2014/Nov/43