SQL injection - CVE-2018-7772
Published: April 10, 2018
Vulnerability identifier: #VU11657
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2018-7772
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor:
Affected software:
Detailed vulnerability description
The vulnerability allows a remote attacker to execute arbitrary SQL commands in web application database.
The weakness exists within processing of applets which are exposed on the web service due to insufficient sanitization of user-supplied data. A remote attacker can submit a specially crafted loginSeed parameter, which can be embedded in the HTTP cookie of the request to vulnerable script and execute arbitrary SQL commands in web application database.
How to mitigate CVE-2018-7772
Install update from vendor's website.