6.5

CVE-2013-7225

Exploit
Multiple SQL injection vulnerabilities in app/controllers/home_controller.rb in Fat Free CRM before 0.12.1 allow remote authenticated users to execute arbitrary SQL commands via (1) the homepage timeline feature or (2) the activity feature.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Fatfreecrm ≫ Fat Free Crm Version <= 0.12.0
Fatfreecrm ≫ Fat Free Crm Version0.9.6
Fatfreecrm ≫ Fat Free Crm Version0.9.7
Fatfreecrm ≫ Fat Free Crm Version0.9.8
Fatfreecrm ≫ Fat Free Crm Version0.9.9
Fatfreecrm ≫ Fat Free Crm Version0.9.10
Fatfreecrm ≫ Fat Free Crm Version0.10.1
Fatfreecrm ≫ Fat Free Crm Version0.11.0
Fatfreecrm ≫ Fat Free Crm Version0.11.1
Fatfreecrm ≫ Fat Free Crm Version0.11.2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.93% 0.773
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.5 8 6.4
AV:N/AC:L/Au:S/C:P/I:P/A:P
CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

http://openwall.com/lists/oss-security/2013/12/28/2
http://seclists.org/fulldisclosure/2013/Dec/199
http://www.phenoelit.org/stuff/ffcrm.txt
Exploit
https://github.com/fatfreecrm/fat_free_crm/issues/300
https://github.com/fatfreecrm/fat_free_crm/wiki/Fixing-security-vulnerabilities-%2827th-Dec-2013%29
Vendor Advisory
https://github.com/fatfreecrm/fat_free_crm/commit/078035f1ef73ed85285ac9d128c3c5f670cef066
Patch
Exploit
https://github.com/fatfreecrm/fat_free_crm/commit/d4b2de81a4d8c1b201482edcb2488ed9280a65fd
Patch
Exploit