Lucene search

Dsquare SecurityE-361

HistoryMar 04, 2014 - 12:00 a.m.

AdRotate library/clicktracker.php track Parameter SQL Injection

2014-03-0400:00:00

Dsquare Security

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.009 Low

EPSS

Percentile

81.2%

JSON

AdRotate contains a flaw that may allow carrying out an SQL injection attack.The issue is due to the library/clicktracker.php script not properly sanitizing user-supplied input to the 'track' parameter. This may allow a remote attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

Vulnerability Type: SQL Injection

For the exploit source code contact DSquare Security sales team.

References

vulners.com/BID/BID:65709

vulners.com/OSVDB/OSVDB:103578

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.009 Low

EPSS

Percentile

81.2%

JSON

Related for E-361