CVE-2013-2945 SQL injection vulnerability in blogs/admin.php in b2evolution before 4.1.7 allows remote authenticated administrators to execute arbitrary SQL commands via the show_statuses[] parameter. NOTE: this ca...
MediumCVSS 6.5
EPSS 2.8%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
SQL injection vulnerability in blogs/admin.php in b2evolution before 4.1.7 allows remote authenticated administrators to execute arbitrary SQL commands via the show_statuses[] parameter. NOTE: this can be leveraged using CSRF to allow remote unauthenticated attackers to execute arbitrary SQL commands.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| b2evolution | <= 4.1.6 | No fix listed |
| b2evolution | = 4.1.0 | No fix listed |
| b2evolution | = 4.1.1 | No fix listed |
| b2evolution | = 4.1.2 | No fix listed |
| b2evolution | = 4.1.3 | No fix listed |
| b2evolution | = 4.1.4 | No fix listed |
| b2evolution | = 4.1.5 | No fix listed |
References
- 20130501 SQL Injection in b2evolution exploit mailing-list
- b2evolution.net patch vendor-advisory
- 92905 vdb-entry
- packetstormsecurity.com exploit
- 59599 exploit vdb-entry
- b2evolution-admin-sql-injection(83950) vdb-entry
- www.htbridge.com exploit