NVD

Id
38575  
Name
CVE-2013-2559  
Description
SQL injection vulnerability in Symphony CMS before 2.3.2 allows remote authenticated users to execute arbitrary SQL commands via the sort parameter to system/authors/. NOTE: this can be leveraged using CSRF to allow remote unauthenticated attackers to execute arbitrary SQL commands.  
Reject
 
CVSS Version
2  
CVSS Score
6.5  
Severity
Medium  
CVSS Base Score
6.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8  
CVSS Vector
(AV:N/AC:L/Au:S/C:P/I:P/A:P)  
Pub Date
2017-01-18  
Published
2014-03-27  
Modified Date
2014-03-27  
Seq
2013-2559  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
197882 38575 CVE-2013-2559 20130403 SQL Injection Vulnerability in Symphony  View
197883 38575 CVE-2013-2559 http://www.getsymphony.com/download/releases/version/2.3.2  View
197884 38575 CVE-2013-2559 58843  View
197885 38575 CVE-2013-2559 symphony-sort-sql-injection(83227)  View
197886 38575 CVE-2013-2559 https://github.com/symphonycms/symphony-2/commit/6c8aa4e9c810994f7632837487426867ce50f468  View
197887 38575 CVE-2013-2559 https://www.htbridge.com/advisory/HTB23148  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
24685 JVNDB-2013-006260 Symphony CMS における SQL インジェクションの脆弱性 Symphony CMS には、SQL インジェクションの脆弱性が存在します。 CVE-2013-2559 62501 CVE-2013-2559 38575 6.5 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-006260.html 2013-03-20 2014-03-28 View