PT-2019-11977 · Domoticz · Domoticz

Fabio Carretto · Published 2019-03-31 · Updated 2019-05-03 · CVE-2019-10664

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Domoticz versions prior to 4.10578

Description The issue allows SQL Injection via the idx parameter in the CWebServer::GetFloorplanImage function in WebServer.cpp.

Recommendations For versions prior to 4.10578, update to version 4.10578 or later to resolve the issue.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2019-10664

Affected Products

Domoticz

References · 5

• 🔥 https://exploit-db.com/exploits/46773 · Exploit
• https://github.com/domoticz/domoticz/commit/ee70db46f81afa582c96b887b73bcd2a86feda00 · Patch
• https://osv.dev/vulnerability/CVE-2019-10664 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10664 · Security Note
• http://packetstormsecurity.com/files/152678/Domoticz-4.10577-Unauthenticated-Remote-Command-Execution.html · Note