CVE-2015-7568 SQL injection vulnerability in the password recovery feature in Yeager CMS 1.2.1 allows remote attackers to change the account credentials of known users via the "userEmail" parameter.
CriticalCVSS 9.8
EPSS 4.1%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
SQL injection vulnerability in the password recovery feature in Yeager CMS 1.2.1 allows remote attackers to change the account credentials of known users via the "userEmail" parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| yeager cms | = 1.2.1 | No fix listed |
References
- packetstormsecurity.com exploit patch third-party-advisory vdb-entry
- 20160210 SEC Consult SA-20160210-0 :: Yeager CMS Multiple Vulnerabilities mailing-list patch third-party-advisory
- 20160210 SEC Consult SA-20160210-0 :: Yeager CMS Multiple Vulnerabilities exploit mailing-list third-party-advisory vdb-entry
- 39436 exploit patch third-party-advisory vdb-entry