SQL Injection in Webedition Cms
CVE-2014-2303
Multiple SQL injection vulnerabilities in the file browser component (we_fs.php) in webEdition CMS before 6.2.7-s1.2 and 6.3.x through 6.3.8 before -s1 allow remote attackers to execute arbitrary SQL commands via the (1) table or (2) order parameter.
Vulnerability class: SQL Injection
Published · last modified .
CVSS v2 metric
CVSS v2 base score 7.5 (High). Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.026 (84.6th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 85th percentile — 84.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.026 · newest: 0.026 · change: 0.000
Affected products
- Webedition Cms — versions 6.2.7.0, 6.3.3.0, 6.3.8.0
Weakness classification (CWE)
References
- www.securityfocus.com/archive/1/532231/100/0/threaded (mailing-list)
- packetstormsecurity.com/files/126862/webEdition-CMS-6.3.8.0-svn6985-SQL-Injecti… (Exploit)
- seclists.org/fulldisclosure/2014/May/148 (mailing-list, Exploit)
- www.redteam-pentesting.de/en/advisories/rt-sa-2014-005/-sql-injection-in-webedi… (Exploit)
- www.securityfocus.com/bid/67689 (Exploit, vdb-entry)
- www.webedition.org/de/aktuelles/allgemein/Wichtiges-Sicherheitsupdate-fuer-CMS-… (Vendor Advisory)