CVE-2012-3468

Опубликовано: 12 авг. 2012

Источник: nvd

CVSS2: 7.5

EPSS Низкий

Описание

Multiple SQL injection vulnerabilities in the Ushahidi Platform before 2.5 allow remote attackers to execute arbitrary SQL commands via vectors related to (1) the verify function in application/controllers/alerts.php, (2) the save_all function in application/models/settings.php, or (3) the media type to the timeline function in application/controllers/json.php.

Ссылки

http://openwall.com/lists/oss-security/2012/08/09/5
https://github.com/ushahidi/Ushahidi_Web/commit/4764792
Exploit
Patch
https://github.com/ushahidi/Ushahidi_Web/commit/d954093
Exploit
Patch
https://github.com/ushahidi/Ushahidi_Web/commit/fdb48d1
Exploit
Patch
http://openwall.com/lists/oss-security/2012/08/09/5
https://github.com/ushahidi/Ushahidi_Web/commit/4764792
Exploit
Patch
https://github.com/ushahidi/Ushahidi_Web/commit/d954093
Exploit
Patch
https://github.com/ushahidi/Ushahidi_Web/commit/fdb48d1
Exploit
Patch

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:ushahidi:ushahidi_platform:*:*:*:*:*:*:*:*

Версия до 2.4.1 (включая)

cpe:2.3:a:ushahidi:ushahidi_platform:1.0:*:*:*:*:*:*:*

cpe:2.3:a:ushahidi:ushahidi_platform:1.2:*:*:*:*:*:*:*

cpe:2.3:a:ushahidi:ushahidi_platform:2.0:*:*:*:*:*:*:*

cpe:2.3:a:ushahidi:ushahidi_platform:2.1:*:*:*:*:*:*:*

cpe:2.3:a:ushahidi:ushahidi_platform:2.2:*:*:*:*:*:*:*

cpe:2.3:a:ushahidi:ushahidi_platform:2.2.1:*:*:*:*:*:*:*

cpe:2.3:a:ushahidi:ushahidi_platform:2.3.1:*:*:*:*:*:*:*

cpe:2.3:a:ushahidi:ushahidi_platform:2.3.2:*:*:*:*:*:*:*

cpe:2.3:a:ushahidi:ushahidi_platform:2.4:*:*:*:*:*:*:*

EPSS

Процентиль: 60%

0.0039

Низкий

7.5 High

CVSS2

Дефекты

CWE-89

Связанные уязвимости

GHSA-qvpv-3hvr-c7gq

github

больше 3 лет назад