What is CVE-2017-11174?

CVE-2017-11174 is a critical-severity vulnerability in Xoops, classified under SQL Injection. CVSS score: 9.8/10. Published 2017-07-12.

How severe is CVE-2017-11174?

Critical severity. CVSS v3 base score is 9.8 out of 10.

SQL Injection in Xoops

CVE-2017-11174

In install/page_dbsettings.php in the Core distribution of XOOPS 2.5.8.1, unfiltered data passed to CREATE and ALTER SQL queries caused SQL Injection in the database settings page, related to use of GBK in CHARACTER SET and COLLATE clauses.

Vulnerability class: SQL Injection

EPSS: 0.010 (60.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Xoops — versions 2.5.8.1
N/a — versions n/a

Weakness classification (CWE)

CWE-89 — SQL Injection

References

cve@mitre.org (Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2017-11174?: CVE-2017-11174 is a critical-severity vulnerability in Xoops, classified under SQL Injection. CVSS score: 9.8/10. Published 2017-07-12.
How severe is CVE-2017-11174?: Critical severity. CVSS v3 base score is 9.8 out of 10.