high8.8Public exploit code
CVE-2017-14757
OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might be affected as well) is prone to SQL Inj…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- OpenText Document Sciences xPression 4.5SP1 Patch 13 - 'jobRunId' SQL Injection2017-10-02 · webapps · jsp
Impact
OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might be affected as well) is prone to SQL Injection: /xDashboard/html/jobhistory/downloadSupportFile.action, parameter: jobRunId. In order for this vulnerability to be exploited, an attacker must authenticate to the application first.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Opentext | Document Sciences Xpression | through 4.5 |
Weakness classification
References
- NVD record
- CVE.org record
- http://seclists.org/fulldisclosure/2017/Oct/8
- https://knowledge.opentext.com/knowledge/llisapi.dll/Open/68982774
- https://www.exploit-db.com/exploits/42939/
- http://seclists.org/fulldisclosure/2017/Oct/8
- https://knowledge.opentext.com/knowledge/llisapi.dll/Open/68982774
- https://www.exploit-db.com/exploits/42939/