Summary
This host is installed with CIS Manager and is prone to SQL injection vulnerability.
Impact
Successful exploitation will allow attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.
Impact Level: Application
Solution
No solution or patch is available as of 30th January, 2015. Information regarding this issue will be updated once the solution details are available.
For updates refer to http://www.construtiva.com.br/cismanager
Insight
The flaw is due to the /autenticar/lembrarlogin.asp script not properly sanitizing user-supplied input to the 'email' parameter.
Affected
CIS Manager CMS
Detection
Send a crafted data via HTTP GET request and check whether it is able to read SQL injection error.
References
Severity
Classification
-
CVE CVE-2014-3749 -
CVSS Base Score: 7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P
Related Vulnerabilities
- A-Blog 'sources/search.php' SQL Injection Vulnerability
- ArticleSetup Multiple Cross-Site Scripting and SQL Injection Vulnerabilities
- Alcatel-Lucent OmniPCX Enterprise Remote Command Execution Vulnerability
- ASP-Dev XM Event Diary Multiple Vulnerabilities
- 68designs 68kb Multiple Remote File Include Vulnerabilities