CVE-2018-25257

Adianti Framework 5.5.0 and 5.6.0 SQL Injection via Profile

CVSS 7.1 HIGHEPSS 0.2%CWE-89

Adianti Framework 5.5.0 and 5.6.0 contains an SQL injection vulnerability that allows authenticated users to manipulate database queries by injecting SQL code through the name field in SystemProfileForm. Attackers can submit crafted SQL statements in the profile edit endpoint to modify user credentials and gain administrative access.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Productos afectados

adianti · Adianti Framework

PoCs públicas encontradas — 1

cve_referencewww.exploit-db.com/exploits/46217no verificado

⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.

¿Quieres saber si tu infraestructura está expuesta a esto?

Hablar con TrueHacking →

Referencias

https://www.exploit-db.com/exploits/46217 https://www.vulncheck.com/advisories/adianti-framework-and-sql-injection-via-profile