CVE-2015-7568

Опубликовано: 24 апр. 2017

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

SQL injection vulnerability in the password recovery feature in Yeager CMS 1.2.1 allows remote attackers to change the account credentials of known users via the "userEmail" parameter.

Ссылки

http://packetstormsecurity.com/files/135716/Yeager-CMS-1.2.1-File-Upload-SQL-Injection-XSS-SSRF.html
Exploit
Patch
Third Party Advisory
VDB Entry
http://seclists.org/fulldisclosure/2016/Feb/44
Mailing List
Patch
Third Party Advisory
http://www.securityfocus.com/archive/1/537493/100/0/threaded
Exploit
Third Party Advisory
VDB Entry
https://www.exploit-db.com/exploits/39436/
Exploit
Patch
Third Party Advisory
VDB Entry
http://packetstormsecurity.com/files/135716/Yeager-CMS-1.2.1-File-Upload-SQL-Injection-XSS-SSRF.html
Exploit
Patch
Third Party Advisory
VDB Entry
http://seclists.org/fulldisclosure/2016/Feb/44
Mailing List
Patch
Third Party Advisory
http://www.securityfocus.com/archive/1/537493/100/0/threaded
Exploit
Third Party Advisory
VDB Entry
https://www.exploit-db.com/exploits/39436/
Exploit
Patch
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:yeager:yeager_cms:1.2.1:*:*:*:*:*:*:*

EPSS

Процентиль: 90%

0.05854

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-89

Связанные уязвимости

GHSA-2mhr-7vwh-hrjc