PT-2017-6711 · Fiyo · Fiyo Cms

Publicado 2017-11-21 · Atualizado 2017-12-12 · CVE-2015-3934

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Fiyo CMS version 2.0 1.9.1

Description The issue concerns SQL injection vulnerabilities that allow remote attackers to execute arbitrary SQL commands. This can be achieved via the id parameter to the "apps/app article/controller/rating.php" endpoint or the user parameter to the "user/login" endpoint.

Recommendations For Fiyo CMS version 2.0 1.9.1, as a temporary workaround, consider restricting access to the rating.php and login endpoints until a patch is available. Avoid using the id and user parameters in the affected endpoints until the issue is resolved.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2015-3934

Produtos afetados

Fiyo Cms

Referências · 3

• 🔥 https://exploit-db.com/exploits/37446 · Exploit
• http://packetstormsecurity.com/files/132479/Fiyo-CMS-2.0_1.9.1-SQL-Injection.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-3934 · Nota de Segurança