#VU41848 SQL injection in b2evolution - CVE-2013-7352
Published: April 2, 2014 / Updated: August 10, 2020
Vulnerability identifier: #VU41848
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2013-7352
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
b2evolution
b2evolution
Software vendor:
b2evolution.net
b2evolution.net
Description
The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.
The vulnerability exists due to insufficient sanitization of user-supplied data passed via the show_statuses[] parameter, related to CVE-2013-2945. A remote attacker can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.
Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.
Remediation
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.