PT-2017-6711 · Fiyo · Fiyo Cms

Published 2017-11-21 · Updated 2017-12-12 · CVE-2015-3934

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Fiyo CMS version 2.0 1.9.1

Description The issue concerns SQL injection vulnerabilities that allow remote attackers to execute arbitrary SQL commands. This can be achieved via the id parameter to the "apps/app article/controller/rating.php" endpoint or the user parameter to the "user/login" endpoint.

Recommendations For Fiyo CMS version 2.0 1.9.1, as a temporary workaround, consider restricting access to the rating.php and login endpoints until a patch is available. Avoid using the id and user parameters in the affected endpoints until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2015-3934

Affected Products

Fiyo Cms

References · 3

• 🔥 https://exploit-db.com/exploits/37446 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-3934 · Security Note
• http://packetstormsecurity.com/files/132479/Fiyo-CMS-2.0_1.9.1-SQL-Injection.html · Note