NVD

Id
23751  
Name
CVE-2015-1428  
Description
Multiple SQL injection vulnerabilities in Sefrengo before 1.6.2 allow (1) remote attackers to execute arbitrary SQL commands via the sefrengo cookie in a login to backend/main.php or (2) remote authenticated users to execute arbitrary SQL commands via the value_id parameter in a save_value action to backend/main.php.  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2015-02-03  
Modified Date
2015-02-04  
Seq
2015-1428  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
126279 23751 CVE-2015-1428 35972  View
126280 23751 CVE-2015-1428 http://www.itas.vn/news/itas-team-found-out-multiple-sql-injection-vulnerabilities-in-sefrengo-cms-v1-6-1-74.html  View
126281 23751 CVE-2015-1428 20150202 Sefrengo CMS v1.6.1 - Multiple SQL Injection Vulnerabilities  View
126282 23751 CVE-2015-1428 https://github.com/sefrengo-cms/sefrengo-1.x/commit/0b1edd4b22a47743eff7cfaf884ba2a4e06e15eb  View
126283 23751 CVE-2015-1428 https://github.com/sefrengo-cms/sefrengo-1.x/commit/22c0d16bfd715631ed317cc990785ccede478f07  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
6116 JVNDB-2015-001436 Sefrengo における SQL インジェクションの脆弱性 Sefrengo には、SQL インジェクションの脆弱性が存在します。 CVE-2015-1428 78653 CVE-2015-1428 23751 7.5 http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-001436.html 2015-01-25 2015-02-13 View