PT-2023-10108 · Unknown · Is Projecto2

Published 2023-01-02 · Updated 2024-05-17 · CVE-2014-125038

Positive Technologies (AI Summary)

CVSS v2.0

5.2

Medium

Base vector

AV:A/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions IS Projecto2 (affected versions not specified)

Description A critical vulnerability has been found in IS Projecto2, affecting unknown code in the NewsBean.java file. The manipulation of the date argument leads to SQL injection.

Recommendations Apply the patch aa128b2c9c9fdcbbf5ecd82c1e92103573017fe0 to fix this issue. As a temporary workaround, consider restricting the manipulation of the date argument to minimize the risk of SQL injection exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2014-125038

Affected Products

Is Projecto2

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2014-125038 · Security Note
• https://github.com/rfsimoes/IS_Projecto2/commit/aa128b2c9c9fdcbbf5ecd82c1e92103573017fe0 · Patch
• https://t.me/cvenotify/41115 · Telegram Post
• https://t.me/cibsecurity/55742 · Telegram Post
• https://vuldb.com/?ctiid.217192 · Note
• https://vuldb.com/?id.217192 · Note