critical9.8Public exploit code
CVE-2017-14738
FileRun (version 2017.09.18 and below) suffers from a remote SQL injection vulnerability due to a failure to sanitize input in the metafield parameter inside t…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- FileRun < 2017.09.18 - SQL Injection2017-09-29 · webapps · php
Impact
FileRun (version 2017.09.18 and below) suffers from a remote SQL injection vulnerability due to a failure to sanitize input in the metafield parameter inside the metasearch module (under the search function).
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Filerun | Filerun | through 2017.09.18 |
Weakness classification
References
- NVD record
- CVE.org record
- http://feedback.filerun.com/topics/189-critical-security-update-available/
- https://blog.spentera.com/2017/09/29/blind-sql-injection-vulnerability-in-filerun-2017-09-18/
- https://www.exploit-db.com/exploits/42922/
- http://feedback.filerun.com/topics/189-critical-security-update-available/
- https://blog.spentera.com/2017/09/29/blind-sql-injection-vulnerability-in-filerun-2017-09-18/
- https://www.exploit-db.com/exploits/42922/