PT-2017-11797 · Xoops · Xoops

Nguyen Thanh Nguyen · Published 2017-07-12 · Updated 2017-07-27 · CVE-2017-11174

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions XOOPS version 2.5.8.1

Description The issue is related to SQL Injection in the database settings page due to unfiltered data being passed to CREATE and ALTER SQL queries. This is caused by the use of GBK in CHARACTER SET and COLLATE clauses in the install/page dbsettings.php file of the Core distribution.

Recommendations For XOOPS version 2.5.8.1, consider restricting access to the database settings page until a patch is available, and avoid using the GBK character set in CHARACTER SET and COLLATE clauses to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2017-11174

Affected Products

Xoops

References · 3

• https://osv.dev/vulnerability/CVE-2017-11174 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-11174 · Security Note
• https://tsublogs.wordpress.com/2017/07/12/xoops-core-2-5-8-1-install-db-sql-injection · Note