SQL Injection in Betster Project

CVE-2015-2237

Multiple SQL injection vulnerabilities in Betster (aka PHP Betoffice) 1.0.4 allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) showprofile.php or (2) categoryedit.php or (3) username parameter in a login to index.php.

Vulnerability class: SQL Injection

EPSS: 0.024 (82.3th percentile) — read the EPSS interpretation.

Affected products

Betster_project Betster — versions 1.0.4
N/a — versions n/a

Weakness classification (CWE)

CWE-89 — SQL Injection

References

cve@mitre.org (exploit, x_refsource_EXPLOIT-DB)
cve@mitre.org (mailing-list, x_refsource_BUGTRAQ)
cve@mitre.org (Exploit, x_refsource_MISC)