CVE-2014-3871 Multiple SQL injection vulnerabilities in register.php in Geodesic Solutions GeoCore MAX 7.3.3 (formerly GeoClassifieds and GeoAuctions) allow remote attackers to execute arbitrary SQL commands via th...
HighCVSS 7.5
EPSS 2.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple SQL injection vulnerabilities in register.php in Geodesic Solutions GeoCore MAX 7.3.3 (formerly GeoClassifieds and GeoAuctions) allow remote attackers to execute arbitrary SQL commands via the (1) c[password] or (2) c[username] parameter. NOTE: the b parameter to index.php vector is already covered by CVE-2006-3823.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| geodesicsolutions geocore max | = 7.3.3 | No fix listed |
References
- geodesicsolutions.com
- 106364 vdb-entry
- packetstormsecurity.com exploit
- 58308 third-party-advisory
- 33075 exploit
- 67078 exploit vdb-entry