PT-2017-7404 · Bitrix · Orion.Extfeedbackform

Published 2017-08-24 · Updated 2018-10-09 · CVE-2015-8355

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Bitrix orion.extfeedbackform module versions prior to 2.1.3

Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via the order or "by" parameter to the "admin/orion.extfeedbackform efbf forms.php" endpoint.

Recommendations For versions prior to 2.1.3, update the orion.extfeedbackform module to version 2.1.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the "admin/orion.extfeedbackform efbf forms.php" endpoint and avoid using the order or "by" parameters until the update is applied.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2015-8355

Affected Products

Orion.Extfeedbackform

References · 3

• 🔥 https://htbridge.com/advisory/HTB23280 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-8355 · Security Note
• http://securityfocus.com/archive/1/537130/100/0/threaded · Note