CVE-2014-1597 SQL injection vulnerability in the CMDB web application in synetics i-doit pro before 1.2.5 and i-doit open allows remote attackers to execute arbitrary SQL commands via the objID parameter to the def...
HighCVSS 7.5
EPSS 1.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
SQL injection vulnerability in the CMDB web application in synetics i-doit pro before 1.2.5 and i-doit open allows remote attackers to execute arbitrary SQL commands via the objID parameter to the default URI.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| i-doit | <= 1.2.4 | No fix listed |
| i-doit | All versions | No fix listed |
| i-doit | = 1.0 | No fix listed |
| i-doit | = 1.0.2 | No fix listed |
| i-doit | = 1.1.1 | No fix listed |
| i-doit | = 1.1.2 | No fix listed |
| i-doit | = 1.2.1 | No fix listed |
| i-doit | = 1.2.2 | No fix listed |
| i-doit | = 1.2.3 | No fix listed |
References
- 20140217 SQL Injection i-doit Pro (CVE-2014-1597) exploit mailing-list
- 56931 third-party-advisory vendor-advisory
- www.csnc.ch exploit
- www.i-doit.com
- 65557 exploit vdb-entry
- idoit-cve20141597-sql-injection(91269) vdb-entry