9.8
CVE-2015-10016
- EPSS 0.66%
- Veröffentlicht 06.01.2023 10:15:09
- Zuletzt bearbeitet 21.11.2024 02:24:10
- Quelle cna@vuldb.com
- CVE-Watchlists
- Unerledigt
Loginjeff-kelley opensim-utils regionscrits.php DatabaseForRegion sql injection
A vulnerability, which was classified as critical, has been found in jeff-kelley opensim-utils. Affected by this issue is the function DatabaseForRegion of the file regionscrits.php. The manipulation of the argument region leads to sql injection. The patch is identified as c29e5c729a833a29dbf5b1e505a0553fe154575e. It is recommended to apply a patch to fix this issue. VDB-217550 is the identifier assigned to this vulnerability.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Opensim-utils Project ≫ Opensim-utils Version < 12-14-2015
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.66% | 0.465 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 9.8 | 3.9 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
| cna@vuldb.com | 5.5 | 2.1 | 3.4 |
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
|
| cna@vuldb.com | 5.2 | 5.1 | 6.4 |
AV:A/AC:L/Au:S/C:P/I:P/A:P
|
CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
https://github.com/jeff-kelley/opensim-utils/commit/c29e5c729a833a29dbf5b1e505a0553fe154575e
https://vuldb.com/?ctiid.217550
https://vuldb.com/?id.217550