medium6.5Public exploit code
CVE-2014-9435
Multiple SQL injection vulnerabilities in Absolut Engine 1.73 allow remote authenticated users to execute arbitrary SQL commands via the (1) sectionID paramete…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Absolut Engine 1.73 - Multiple Vulnerabilities2015-01-01 · webapps · php
Impact
Multiple SQL injection vulnerabilities in Absolut Engine 1.73 allow remote authenticated users to execute arbitrary SQL commands via the (1) sectionID parameter to admin/managersection.php, (2) userID parameter to admin/edituser.php, (3) username parameter to admin/admin.php, or (4) title parameter to admin/managerrelated.php.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Absolutengine | Absolut Engine | Version 1.73 |
Weakness classification
References
- NVD record
- CVE.org record
- http://seclists.org/fulldisclosure/2014/Dec/131
- http://sroesemann.blogspot.de/2014/12/sroeadv-2014-08.html
- http://www.securityfocus.com/bid/71822
- http://seclists.org/fulldisclosure/2014/Dec/131
- http://sroesemann.blogspot.de/2014/12/sroeadv-2014-08.html
- http://www.securityfocus.com/bid/71822