Japan Vulnerability NotesJVN:20812625JVN#20812625: Advance-Flow vulnerable to SQL injection
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.003 Low
EPSS
Percentile
65.3%
Advance-Flow provided by OSK Co., LTD contains an issue in processing input data, which may result in SQL injection.
Impact
A user may obtain or alter information on the database.
Solution
Do not use Advance-Flow
The developer has stated that the support of Advance-Flow has been discontinued thus recommends users to stop using Advance-Flow.
Note that the successor to Advance-Flow, eValue NS, is not affected by this vulnerability.
Products Affected
- Advance-Flow Ver 4.41 and earlier
- Advance-Flow Forms Ver 4.41 and earlier
Related
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.003 Low
EPSS
Percentile
65.3%