CVE-2014-3719 Multiple SQL injection vulnerabilities in cgi-bin/review_m.cgi in Ex Libris ALEPH 500 (Integrated library management system) 18.1 and 20 allow remote attackers to execute arbitrary SQL commands via th...
CriticalCVSS 9.8
EPSS 2.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple SQL injection vulnerabilities in cgi-bin/review_m.cgi in Ex Libris ALEPH 500 (Integrated library management system) 18.1 and 20 allow remote attackers to execute arbitrary SQL commands via the (1) find, (2) lib, or (3) sid parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| exlibrisgroup aleph 500 | = 18.1 | No fix listed |
| exlibrisgroup aleph 500 | = 20.0 | No fix listed |
References
- packetstormsecurity.com exploit third-party-advisory vdb-entry
- seclists.org mailing-list third-party-advisory