CVE-2015-8355 Multiple SQL injection vulnerabilities in the orion.extfeedbackform module before 2.1.3 for Bitrix allow remote authenticated users to execute arbitrary SQL commands via the (1) order or (2) "by" para...
HighCVSS 8.8
EPSS 1.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple SQL injection vulnerabilities in the orion.extfeedbackform module before 2.1.3 for Bitrix allow remote authenticated users to execute arbitrary SQL commands via the (1) order or (2) "by" parameter to admin/orion.extfeedbackform_efbf_forms.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| orion-soft bitrix | <= 2.1.2 | No fix listed |
References
- 20151216 SQL Injection in orion.extfeedbackform Bitrix Module mailing-list
- www.htbridge.com exploit third-party-advisory