Lucene search

VulDBCVELIST:CVE-2015-10084

HistoryFeb 21, 2023 - 3:00 p.m.

CVE-2015-10084 irontec klear-library BaseController.php _prepareWhere sql injection

2023-02-2115:00:06

CWE-89

VulDB

www.cve.org

irontec klear-library

basecontroller.php

_preparewhere

sql injection

vulnerability

upgrade

marla

patch

b25262de52fdaffde2a4434fc2a84408b304fbc5

vdb-221504

CVSS2

5.2

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:A/AC:L/Au:S/C:P/I:P/A:P

CVSS3

5.5

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

AI Score

9.8

Confidence

High

EPSS

0.023

Percentile

90.0%

JSON

A vulnerability was found in irontec klear-library chloe and classified as critical. Affected by this issue is the function _prepareWhere of the file Controller/Rest/BaseController.php. The manipulation leads to sql injection. Upgrading to version marla is able to address this issue. The name of the patch is b25262de52fdaffde2a4434fc2a84408b304fbc5. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-221504.

CNA Affected

[
  {
    "vendor": "irontec",
    "product": "klear-library",
    "versions": [
      {
        "version": "chloe",
        "status": "affected"
      }
    ]
  }
]

References

github.com/irontec/klear-library/commit/b25262de52fdaffde2a4434fc2a84408b304fbc5

github.com/irontec/klear-library/tree/marla

vuldb.com/?ctiid.221504

vuldb.com/?id.221504

CVSS2

5.2

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:A/AC:L/Au:S/C:P/I:P/A:P

CVSS3

5.5

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

AI Score

9.8

Confidence

High

EPSS

0.023

Percentile

90.0%

JSON

Related for CVELIST:CVE-2015-10084