Lucene search

[email protected]CVE-2015-2562

HistoryMar 20, 2015 - 2:59 p.m.

CVE-2015-2562

2015-03-2014:59:04

CWE-89

[email protected]

web.nvd.nist.gov

cve-2015-2562

sql injection

web-dorado ecommerce wd

joomla

remote attack

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

8.8 High

AI Score

Confidence

Low

0.035 Low

EPSS

Percentile

91.6%

JSON

Multiple SQL injection vulnerabilities in the Web-Dorado ECommerce WD (com_ecommercewd) component 1.2.5 for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) search_category_id, (2) sort_order, or (3) filter_manufacturer_ids in a displayproducts action to index.php.

Affected configurations

NVD

Node

web-doradoecommerce_wdMatch1.2.5joomla\!

CPENameOperatorVersion
web-dorado:ecommerce_wdweb-dorado ecommerce wdeq1.2.5

CPE	Name	Operator	Version
web-dorado:ecommerce_wd	web-dorado ecommerce wd	eq	1.2.5

References

packetstormsecurity.com/files/130896/Joomla-ECommerce-WD-1.2.5-SQL-Injection.html

seclists.org/fulldisclosure/2015/Mar/123

www.securityfocus.com/bid/73285

www.exploit-db.com/exploits/36439/

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

8.8 High

AI Score

Confidence

Low

0.035 Low

EPSS

Percentile

91.6%

JSON

Related for CVE-2015-2562

prion1 metasploit1 cvelist1 nvd1