CVE-2017-12585

Опубликовано: 06 авг. 2017

Источник: nvd

CVSS3: 8.8

CVSS2: 6.5

EPSS Низкий

Описание

SLiMS 8 Akasia through 8.3.1 has SQL injection in admin/AJAX_lookup_handler.php (tableName and tableFields parameters), admin/AJAX_check_id.php, and admin/AJAX_vocabolary_control.php. It can be exploited by remote authenticated librarian users.

Ссылки

https://github.com/slims/slims8_akasia/issues/47
Exploit
Third Party Advisory
https://github.com/slims/slims8_akasia/issues/47
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:slims:akasia:8.0:*:*:*:*:*:*:*

cpe:2.3:a:slims:akasia:8.1:*:*:*:*:*:*:*

cpe:2.3:a:slims:akasia:8.2:*:*:*:*:*:*:*

cpe:2.3:a:slims:akasia:8.3:*:*:*:*:*:*:*

cpe:2.3:a:slims:akasia:8.3.1:*:*:*:*:*:*:*

EPSS

Процентиль: 66%

0.00514

Низкий

8.8 High

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-89

Связанные уязвимости

GHSA-9gcv-89r6-88gw