PT-2015-3678 · Couponphp · Couponphp

Gjoko Krstic · Published 2015-01-13 · Updated 2017-09-08 · CVE-2014-10034

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions couponPHP versions prior to 1.2.0

Description The issue concerns SQL injection vulnerabilities in the admin area. These vulnerabilities allow remote administrators to execute arbitrary SQL commands. The vulnerabilities are specifically related to the iDisplayLength and iDisplayStart parameters in the API endpoints "comments paginate.php" and "stores paginate.php" located in "admin/ajax/".

Recommendations For versions prior to 1.2.0, update to version 1.2.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the "comments paginate.php" and "stores paginate.php" files in "admin/ajax/" to minimize the risk of exploitation. Avoid using the iDisplayLength and iDisplayStart parameters in the affected API endpoints until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2014-10034

Affected Products

Couponphp

References · 9

• 🔥 http://zeroscience.mk/en/vulnerabilities/ZSL-2014-5170.php · Exploit
• 🔥 https://exploit-db.com/exploits/32037 · Exploit
• 🔥 http://exploit-db.com/exploits/32037 · Exploit
• 🔥 http://packetstormsecurity.com/files/125480 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-10034 · Security Note
• http://osvdb.org/show/osvdb/103895 · Note
• http://osvdb.org/show/osvdb/103896 · Note
• http://couponphp.com/changelog · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/91550 · Note