#VU11657 SQL injection - CVE-2018-7772
Published: April 10, 2018
Vulnerability identifier: #VU11657
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2018-7772
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
Software vendor:
Description
The vulnerability allows a remote attacker to execute arbitrary SQL commands in web application database.
The weakness exists within processing of applets which are exposed on the web service due to insufficient sanitization of user-supplied data. A remote attacker can submit a specially crafted loginSeed parameter, which can be embedded in the HTTP cookie of the request to vulnerable script and execute arbitrary SQL commands in web application database.
Remediation
Install update from vendor's website.