CVE-2014-3810

2014-06-1914:55:00

CWE-89

[email protected]

web.nvd.nist.gov

sql injection

boonex dolphin

remote administration

cve-2014-3810

cve-2014-4333

nvd

8.1 High

AI Score

Confidence

Low

6.5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

0.003 Low

EPSS

Percentile

69.2%

JSON

SQL injection vulnerability in administration/profiles.php in BoonEx Dolphin 7.1.4 and earlier allows remote authenticated administrators to execute arbitrary SQL commands via the members[] parameter. NOTE: this can be exploited by remote attackers by leveraging CVE-2014-4333.

CPENameOperatorVersion
boonex:dolphinboonex dolphineq7.0.0
boonex:dolphinboonex dolphineq7.0.1
boonex:dolphinboonex dolphineq7.0.4
boonex:dolphinboonex dolphineq7.1.0
boonex:dolphinboonex dolphineq7.0.3
boonex:dolphinboonex dolphineq7.0.7
boonex:dolphinboonex dolphineq7.1.3
boonex:dolphinboonex dolphineq7.1.1
boonex:dolphinboonex dolphineq7.0.2
boonex:dolphinboonex dolphineq7.0.9

CPE	Name	Operator	Version
boonex:dolphin	boonex dolphin	eq	7.0.0
boonex:dolphin	boonex dolphin	eq	7.0.1
boonex:dolphin	boonex dolphin	eq	7.0.4
boonex:dolphin	boonex dolphin	eq	7.1.0
boonex:dolphin	boonex dolphin	eq	7.0.3
boonex:dolphin	boonex dolphin	eq	7.0.7
boonex:dolphin	boonex dolphin	eq	7.1.3
boonex:dolphin	boonex dolphin	eq	7.1.1
boonex:dolphin	boonex dolphin	eq	7.0.2
boonex:dolphin	boonex dolphin	eq	7.0.9