NVD

Id
33070  
Name
CVE-2014-5387  
Description
Multiple SQL injection vulnerabilities in EllisLab ExpressionEngine before 2.9.1 allow remote authenticated users to execute arbitrary SQL commands via the (1) column_filter or (2) category[] parameter to system/index.php or the (3) tbl_sort[0][] parameter in the comment module to system/index.php.  
Reject
 
CVSS Version
2  
CVSS Score
6.5  
Severity
Medium  
CVSS Base Score
6.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8  
CVSS Vector
(AV:N/AC:L/Au:S/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2014-11-04  
Modified Date
2015-09-08  
Seq
2014-5387  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
173504 33070 CVE-2014-5387 http://packetstormsecurity.com/files/128946/EllisLab-ExpressionEngine-Core-SQL-Injection.html  View
173505 33070 CVE-2014-5387 20141103 CVE-2014-5387 - Multiple Authenticated SQL Injections in EllisLab ExpressionEngine Core  View
173506 33070 CVE-2014-5387 70875  View
173507 33070 CVE-2014-5387 https://ellislab.com/expressionengine/user-guide/about/changelog.html  View
173508 33070 CVE-2014-5387 https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-5387  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
16337 JVNDB-2014-005212 EllisLab ExpressionEngine における SQL インジェクションの脆弱性 EllisLab ExpressionEngine には、SQL インジェクションの脆弱性が存在します。 CVE-2014-5387 72676 CVE-2014-5387 33070 6.5 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-005212.html 2014-10-03 2014-11-06 View