PT-2023-10256 · Webbuilders · Silverstripe-Kapost-Bridge

Published 2023-02-10 · Updated 2024-05-17 · CVE-2015-10077

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions webbuilders-group silverstripe-kapost-bridge version 0.3.3

Description A critical issue has been found, affecting the index/getPreview function of the file code/control/KapostService.php. This issue leads to sql injection and can be launched remotely.

Recommendations For version 0.3.3, upgrade to version 0.4.0 to address this issue. As a temporary workaround, consider disabling the index/getPreview function of the KapostService.php file until the patch is applied. Restrict access to the code/control/KapostService.php file to minimize the risk of exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2015-10077

GHSA-32GR-X76G-267W

Affected Products

Silverstripe-Kapost-Bridge

References · 10

• https://github.com/webbuilders-group/silverstripe-kapost-bridge/releases/tag/0.4.0 · Patch
• https://github.com/webbuilders-group/silverstripe-kapost-bridge/commit/2e14b0fd0ea35034f90890f364b130fb4645ff35 · Patch
• https://osv.dev/vulnerability/GHSA-32gr-x76g-267w · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-10077 · Security Note
• https://github.com/webbuilders-group/silverstripe-kapost-bridge · Note
• https://t.me/cvenotify/44039 · Telegram Post
• https://vuldb.com/?ctiid.220471 · Note
• https://vuldb.com/?id.220471 · Note
• https://t.me/cvenotify/44523 · Telegram Post
• https://t.me/cibsecurity/57922 · Telegram Post