PT-2017-11797 · Xoops · Xoops

Nguyen Thanh Nguyen · Publicado 2017-07-12 · Atualizado 2017-07-27 · CVE-2017-11174

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions XOOPS version 2.5.8.1

Description The issue is related to SQL Injection in the database settings page due to unfiltered data being passed to CREATE and ALTER SQL queries. This is caused by the use of GBK in CHARACTER SET and COLLATE clauses in the install/page dbsettings.php file of the Core distribution.

Recommendations For XOOPS version 2.5.8.1, consider restricting access to the database settings page until a patch is available, and avoid using the GBK character set in CHARACTER SET and COLLATE clauses to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2017-11174

Produtos afetados

Xoops

Referências · 3

• https://osv.dev/vulnerability/CVE-2017-11174 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-11174 · Nota de Segurança
• https://tsublogs.wordpress.com/2017/07/12/xoops-core-2-5-8-1-install-db-sql-injection · Nota