critical9.8Public exploit code
CVE-2015-7568
SQL injection vulnerability in the password recovery feature in Yeager CMS 1.2.1 allows remote attackers to change the account credentials of known users via t…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Yeager CMS 1.2.1 - Multiple Vulnerabilities2016-02-10 · webapps · php
Impact
SQL injection vulnerability in the password recovery feature in Yeager CMS 1.2.1 allows remote attackers to change the account credentials of known users via the "userEmail" parameter.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Yeager | Yeager Cms | Version 1.2.1 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/135716/Yeager-CMS-1.2.1-File-Upload-SQL-Injection-XSS-SSRF.html
- http://seclists.org/fulldisclosure/2016/Feb/44
- http://www.securityfocus.com/archive/1/537493/100/0/threaded
- https://www.exploit-db.com/exploits/39436/
- http://packetstormsecurity.com/files/135716/Yeager-CMS-1.2.1-File-Upload-SQL-Injection-XSS-SSRF.html
- http://seclists.org/fulldisclosure/2016/Feb/44
- http://www.securityfocus.com/archive/1/537493/100/0/threaded
- https://www.exploit-db.com/exploits/39436/