vendor:
Seditio
by:
nukedx
7,5
CVSS
HIGH
SQL Injection
89
CWE
Product Name: Seditio
Affected Version From: 1.10 and earlier
Affected Version To: N/A
Patch Exists: YES
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2006
Seditio <= 1.10 Remote SQL Injection (avatarselect id) Vulnerability
A remote SQL injection vulnerability exists in Seditio version 1.10 and earlier. An attacker can exploit this vulnerability by sending a specially crafted HTTP GET request to the vulnerable server. The XVALUE parameter is unique to each user and is used to construct the vulnerable URL. By appending malicious SQL code to the vulnerable URL, an attacker can execute arbitrary SQL commands on the underlying database. For example, an attacker can use this vulnerability to change the password of the first user of Seditio to '123456'.
Mitigation:
Upgrade to the latest version of Seditio.
