Main Vulnerability Database SB2013122002

SB2013122002 - SQL Injection in OpenX Source Revive Adserver

Published: December 20, 2013 Updated: February 20, 2017

Security Bulletin ID SB2013122002

CSH Severity

Critical

Patch available

YES

Number of vulnerabilities 1

Exploitation vector Remote access

Highest impact Code execution

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 1 vulnerability.

1) SQL injection (CVE-ID: CVE-2013-7149)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Amber

The vulnerability allows a remote attacker to execute arbitrary SQL commands in vulnerable application.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can send a specially crafted HTTP request to the XML-RPC script using the "what" parameter and view, add, modify or delete information in the back-end database.

Successful exploitation may allow an attacker to gain unauthorized access to the vulnerable system.

Note: this vulnerability was being actively exploited.

Remediation

Install update from vendor's website.

References

https://www.revive-adserver.com/security/revive-sa-2013-001/