CVE-2014-1206 SQL injection vulnerability in the password reset page in Open Web Analytics (OWA) before 1.5.5 allows remote attackers to execute arbitrary SQL commands via the owa_email_address parameter in a base....
HighCVSS 7.5
EPSS 2.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
SQL injection vulnerability in the password reset page in Open Web Analytics (OWA) before 1.5.5 allows remote attackers to execute arbitrary SQL commands via the owa_email_address parameter in a base.passwordResetRequest action to index.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| openwebanalytics open web analytics | <= 1.5.4 | No fix listed |
| openwebanalytics open web analytics | = 1.0 | No fix listed |
| openwebanalytics open web analytics | = 1.0.1 | No fix listed |
| openwebanalytics open web analytics | = 1.0.2 | No fix listed |
| openwebanalytics open web analytics | = 1.0.3 | No fix listed |
| openwebanalytics open web analytics | = 1.0.4 | No fix listed |
| openwebanalytics open web analytics | = 1.0.5 | No fix listed |
| openwebanalytics open web analytics | = 1.0.6 | No fix listed |
| openwebanalytics open web analytics | = 1.0.7 | No fix listed |
| openwebanalytics open web analytics | = 1.0.8 | No fix listed |
| openwebanalytics open web analytics | = 1.1.0-rc1 | No fix listed |
| openwebanalytics open web analytics | = 1.1.0-rc2 | No fix listed |
| openwebanalytics open web analytics | = 1.1.0-rc3 | No fix listed |
| openwebanalytics open web analytics | = 1.1.0-rc4 | No fix listed |
| openwebanalytics open web analytics | = 1.1.1 | No fix listed |
| openwebanalytics open web analytics | = 1.2.0 | No fix listed |
| openwebanalytics open web analytics | = 1.2.0-rc1 | No fix listed |
| openwebanalytics open web analytics | = 1.2.0-rc2 | No fix listed |
| openwebanalytics open web analytics | = 1.2.0-rc3 | No fix listed |
| openwebanalytics open web analytics | = 1.2.1 | No fix listed |
| openwebanalytics open web analytics | = 1.2.1-rc1 | No fix listed |
| openwebanalytics open web analytics | = 1.2.2 | No fix listed |
| openwebanalytics open web analytics | = 1.2.3 | No fix listed |
| openwebanalytics open web analytics | = 1.2.4 | No fix listed |
| openwebanalytics open web analytics | = 1.3.0 | No fix listed |
Show 15 more
| Product | Affected versions | Fixed in |
|---|---|---|
| openwebanalytics open web analytics | = 1.3.0-rc1 | No fix listed |
| openwebanalytics open web analytics | = 1.3.1 | No fix listed |
| openwebanalytics open web analytics | = 1.4.0 | No fix listed |
| openwebanalytics open web analytics | = 1.4.0-rc1 | No fix listed |
| openwebanalytics open web analytics | = 1.4.0-rc2 | No fix listed |
| openwebanalytics open web analytics | = 1.4.0-rc3 | No fix listed |
| openwebanalytics open web analytics | = 1.4.0-rc4 | No fix listed |
| openwebanalytics open web analytics | = 1.4.1 | No fix listed |
| openwebanalytics open web analytics | = 1.5.0 | No fix listed |
| openwebanalytics open web analytics | = 1.5.0-rc1 | No fix listed |
| openwebanalytics open web analytics | = 1.5.0-rc2 | No fix listed |
| openwebanalytics open web analytics | = 1.5.0-rc3 | No fix listed |
| openwebanalytics open web analytics | = 1.5.1 | No fix listed |
| openwebanalytics open web analytics | = 1.5.2 | No fix listed |
| openwebanalytics open web analytics | = 1.5.3 | No fix listed |
References
- 56350 third-party-advisory vendor-advisory
- wiki.openwebanalytics.com vendor-advisory
- 31738 exploit
- www.secureworks.com exploit
- 20140214 [SWRX-2014-001] Open Web Analytics Pre-Auth SQL Injection mailing-list
- 64774 exploit vdb-entry