CVE-2014-1459

EPSS 2.3%

SQL injection vulnerability in dg-admin/index.php in doorGets CMS 5.2 and earlier allows remote authenticated administrators to execute arbitrary SQL commands via the _position_down_id parameter. NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands.

Affected products

n/a · n/a

public PoCs found — 3

cve_referencepacketstormsecurity.com/files/125078unverified cve_referencewww.exploit-db.com/exploits/31521unverified exploitdbwww.exploit-db.com/exploits/31521unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://packetstormsecurity.com/files/125078 https://exchange.xforce.ibmcloud.com/vulnerabilities/90967 https://github.com/doorgets/doorGets/commit/6b81541fc1e5dd1c70614585c1a04d04ccdb3b19 https://www.htbridge.com/advisory/HTB23197 http://www.exploit-db.com/exploits/31521 http://www.securityfocus.com/archive/1/530931/100/0/threaded http://www.securityfocus.com/bid/65439