PT-2018-12277 · Wolfsight · Wolfsight Cms

Published 2018-07-12 · Updated 2018-09-05 · CVE-2018-14012

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WolfSight CMS version 3.2

Description The issue allows SQL injection via the PATH INFO to the default URI.

Recommendations For WolfSight CMS version 3.2, consider restricting access to the default URI to minimize the risk of exploitation. As a temporary workaround, avoid using user-supplied input in the PATH INFO until a patch is available.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2018-14012

Affected Products

Wolfsight Cms

References · 3

• 🔥 https://exploit-db.com/exploits/44997 · Exploit
• https://osv.dev/vulnerability/CVE-2018-14012 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-14012 · Security Note