high7.2Public exploit code
CVE-2015-7570
Multiple server-side request forgery (SSRF) vulnerabilities in Yeager CMS 1.2.1 allow remote attackers to trigger outbound requests and enumerate open ports vi…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Yeager CMS 1.2.1 - Multiple Vulnerabilities2016-02-10 · webapps · php
Impact
Multiple server-side request forgery (SSRF) vulnerabilities in Yeager CMS 1.2.1 allow remote attackers to trigger outbound requests and enumerate open ports via the dbhost parameter to libs/org/adodb_lite/tests/test_adodb_lite.php, libs/org/adodb_lite/tests/test_datadictionary.php, or libs/org/adodb_lite/tests/test_adodb_lite_sessions.php.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Yeager | Yeager Cms | Version 1.2.1 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/135716/Yeager-CMS-1.2.1-File-Upload-SQL-Injection-XSS-SSRF.html
- http://seclists.org/fulldisclosure/2016/Feb/44
- http://www.securityfocus.com/archive/1/537493/100/0/threaded
- https://www.exploit-db.com/exploits/39436/
- http://packetstormsecurity.com/files/135716/Yeager-CMS-1.2.1-File-Upload-SQL-Injection-XSS-SSRF.html
- http://seclists.org/fulldisclosure/2016/Feb/44
- http://www.securityfocus.com/archive/1/537493/100/0/threaded
- https://www.exploit-db.com/exploits/39436/