PT-2023-10332 · Forumhulp · Forumhulp

Leinad4Mind · Published 2023-01-07 · Updated 2024-05-17 · CVE-2016-15013

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ForumHulp (affected versions not specified)

Description A critical issue was found in ForumHulp searchresults, affecting the list keywords function of the file event/listener.php. The manipulation of the word argument leads to SQL injection.

Recommendations Apply a patch to fix this issue. The patch name is dd8a312bb285ad9735a8e1da58e9e955837b7322. As a temporary workaround, consider disabling the list keywords function until a patch is available. Restrict access to the event/listener.php file to minimize the risk of exploitation. Avoid using the word argument in the affected function until the issue is resolved.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2016-15013

Affected Products

Forumhulp

References · 9

• https://github.com/ForumHulp/searchresults/pull/2 · Patch
• https://github.com/ForumHulp/searchresults/commit/dd8a312bb285ad9735a8e1da58e9e955837b7322 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2016-15013 · Security Note
• https://osv.dev/vulnerability/CVE-2016-15013 · Vendor Advisory
• https://vuldb.com/?id.217628 · Note
• https://vuldb.com/?ctiid.217628 · Note
• https://t.me/cibsecurity/56118 · Telegram Post
• https://t.me/cvenotify/41876 · Telegram Post
• https://t.me/cvenotify/41505 · Telegram Post