PT-2017-14306 · Xavier · Xavier Php Management Panel
Benjamin Kunz Mejri
·
Published
2017-10-28
·
Updated
2017-11-14
·
CVE-2017-15949
CVSS v3.1
7.2
High
| Vector | AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Xavier PHP Management Panel version 2.4
Description
The issue allows SQL injection via the
usertoedit parameter to "admin/adminuseredit.php" or the log id parameter to "admin/editgroup.php".Recommendations
For Xavier PHP Management Panel version 2.4, avoid using the
usertoedit parameter in the "admin/adminuseredit.php" endpoint and the log id parameter in the "admin/editgroup.php" endpoint until the issue is resolved.Exploit
Fix
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Xavier Php Management Panel