Lucene search
HistoryMay 20, 2010 - 5:30 p.m.
CVE-2010-1994
cve-2010-1994
sql injection
index.php
tomatocms
vulnerability
remote attackers
arbitrary sql commands
/news/search
path_info
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
8.6 High
AI Score
Confidence
Low
0.002 Low
EPSS
Percentile
61.1%
SQL injection vulnerability in index.php in TomatoCMS before 2.0.5 allows remote attackers to execute arbitrary SQL commands via the q parameter in conjunction with a /news/search PATH_INFO.
Affected configurations
Node
tomatocmstomatocmsRange≤2.0.4
ORtomatocmstomatocmsMatch2.0.0
ORtomatocmstomatocmsMatch2.0.1
ORtomatocmstomatocmsMatch2.0.2
ORtomatocmstomatocmsMatch2.0.3
ORtomatocmstomatocmsMatch2.0.3.1430
ORtomatocmstomatocmsMatch2.0.3.1622
Related
htbridge
htbridge
SQL Injection Vulnerability in TomatoCMS
2010-06-14 00:00:00
prion
prion
Sql injection
2010-05-20 17:30:00
cvelist
cvelist
CVE-2010-1994
2010-05-20 17:00:00
nvd
nvd
CVE-2010-1994
2010-05-20 17:30:01
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
8.6 High
AI Score
Confidence
Low
0.002 Low
EPSS
Percentile
61.1%
Related for CVE-2010-1994