PT-2023-10007 · Unknown · Fanzila Webfinance

Published 2023-02-03 · Updated 2024-05-17 · CVE-2013-10018

Positive Technologies (AI Summary)

CVSS v2.0

5.2

Medium

Base vector

AV:A/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions fanzila WebFinance version 0.5

Description A critical issue was found in the file htdocs/prospection/save contact.php, where the manipulation of the arguments nom, prenom, email, tel, mobile, client, fonction, and note leads to sql injection.

Recommendations For fanzila WebFinance version 0.5, it is recommended to apply a patch to fix this issue. As a temporary workaround, consider restricting access to the save contact.php file until a patch is available. Avoid using the arguments nom, prenom, email, tel, mobile, client, fonction, and note in the affected functionality until the issue is resolved.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2013-10018

Affected Products

Fanzila Webfinance

References · 5

• https://github.com/fanzila/WebFinance/commit/165dfcaa0520ee0179b7c1282efb84f5a03df114 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2013-10018 · Security Note
• https://t.me/cibsecurity/57514 · Telegram Post
• https://vuldb.com/?id.220057 · Note
• https://vuldb.com/?ctiid.220057 · Note