CVE-2013-3578

2022-10-0316:14:46

CWE-78

CWE-89

[email protected]

web.nvd.nist.gov

cve-2013-3578

sql injection

wave embassy

eras

remote authenticated users

9 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

8.3 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

40.7%

JSON

SQL injection vulnerability in the Help Desk application in Wave EMBASSY Remote Administration Server (ERAS) allows remote authenticated users to execute arbitrary SQL commands via the ct100$4MainController$TextBoxSearchValue parameter (aka the search field), leading to execution of operating-system commands.

Affected configurations

NVD

Node

waveembassy_remote_administration_serverMatch-

waveembassy_remote_administration_server_help_deskMatch-

CPENameOperatorVersion
wave:embassy_remote_administration_serverwave embassy remote administration servereq-
wave:embassy_remote_administration_server_help_deskwave embassy remote administration server help deskeq-

CPE	Name	Operator	Version
wave:embassy_remote_administration_server	wave embassy remote administration server	eq	-
wave:embassy_remote_administration_server_help_desk	wave embassy remote administration server help desk	eq	-