PT-2020-7643 · Unknown · Web2Project

Published 2020-01-31 · Updated 2020-02-05 · CVE-2014-3119

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions web2Project versions 3.1 and earlier

Description The issue allows remote authenticated users to execute arbitrary SQL commands. This can be achieved via the search string parameter in the contacts module to "index.php" or by remote attackers via the updatekey parameter to "do updatecontact.php" or "updatecontact.php".

Recommendations For web2Project versions 3.1 and earlier, update to a version later than 3.1 to resolve the issue. As a temporary workaround, consider restricting access to the search string parameter in the contacts module and the updatekey parameter in "do updatecontact.php" and "updatecontact.php" to minimize the risk of exploitation.

Exploit

Fix

RCE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2014-3119

Affected Products

Web2Project

References · 5

• 🔥 https://exploit-db.com/exploits/33818 · Exploit
• 🔥 https://htbridge.com/advisory/HTB23213 · Exploit
• https://github.com/web2project/web2project/commit/eead99b36f62a8222d9f3a913f1a2268200687ef · Patch
• https://github.com/web2project/web2project/commit/ab5ba92a6aaf0435cd0b2132cf7f9b7b41575a28 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2014-3119 · Security Note