CVE-2024-25400

Опубликовано: 27 фев. 2024

Источник: nvd

CVSS3: 9.8

EPSS Низкий

Описание

Subrion CMS 4.2.1 is vulnerable to SQL Injection via ia.core.mysqli.php. NOTE: this is disputed by multiple third parties because it refers to an HTTP request to a PHP file that only contains a class, without any mechanism for accepting external input, and the reportedly vulnerable method is not present in the file.

Ссылки

https://github.com/intelliants/subrion/issues/910
Exploit
Issue Tracking
Vendor Advisory
https://github.com/intelliants/subrion/issues/910
Exploit
Issue Tracking
Vendor Advisory
https://github.com/intelliants/subrion/issues/910
Exploit
Issue Tracking
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:intelliants:subrion:4.2.1:*:*:*:*:*:*:*

EPSS

Процентиль: 65%

0.00492

Низкий

9.8 Critical

CVSS3

Дефекты

CWE-89

Связанные уязвимости

GHSA-xxf8-fpmr-fw7v

github

больше 1 года назад

Withdrawn Advisory: Subrion CMS vulnerable to SQL Injection

BDU:2024-01968

CVSS3: 7.3

fstec