CVE-2014-2303 Multiple SQL injection vulnerabilities in the file browser component (we_fs.php) in webEdition CMS before 6.2.7-s1.2 and 6.3.x through 6.3.8 before -s1 allow remote attackers to execute arbitrary SQL....
HighCVSS 7.5
EPSS 2.6%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Multiple SQL injection vulnerabilities in the file browser component (we_fs.php) in webEdition CMS before 6.2.7-s1.2 and 6.3.x through 6.3.8 before -s1 allow remote attackers to execute arbitrary SQL commands via the (1) table or (2) order parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| webedition cms | = 6.2.7.0 | No fix listed |
| webedition cms | = 6.3.3.0 | No fix listed |
| webedition cms | = 6.3.8.0 | No fix listed |
References
- packetstormsecurity.com exploit
- 20140528 [RT-SA-2014-005] SQL Injection in webEdition CMS File Browser Installer Script exploit mailing-list
- 20140528 [RT-SA-2014-005] SQL Injection in webEdition CMS File Browser Installer Script mailing-list
- 67689 exploit vdb-entry
- www.webedition.org vendor-advisory
- www.redteam-pentesting.de exploit