CVE-2015-2070

The CVE-2015-2070 entry covers a SQL injection in eTouch SamePage Enterprise Edition 4.4.0.0.239, exploitable via the catId parameter to cm/blogrss/feed, allowing remote SQL commands. The OpenVAS record confirms an active check for eTouch SamePage

CVE-2015-2071

CVE-2015-2071 affects ETouch Systems SamePage Enterprise Edition 4.4.0.0.239. A directory traversal flaw exists in cm/newui/blog/export.jsp that allows remote authenticated users to read arbitrary files via a .. sequence in the filepath parameter. Connected CNVD/NVD entries corroborate the same v...