Summary
The host is installed with Digital Craft AtomCMS and is prone to file upload and sql injection vulnerabilities.
Impact
Successful exploitation will allow attacker to gain unauthorized privileges and manipulate SQL queries in the backend database allowing for the manipulation or disclosure of arbitrary data.
Impact Level: Application
Solution
No solution or patch is available as of 9th February, 2015. Information regarding this issue will be updated once the solution details are available.
or updates refer to https://github.com/thedigicraft/Atom.CMS
Insight
Input passed via the 'id' parameter to /admin/uploads.php script is not properly sanitised before being used.
Affected
Digital Craft AtomCMS version 2.0
Detection
Send a crafted data via HTTP GET request and check whether it is able execute sql query or not.
References
Updated on 2015-03-25
Severity
Classification
-
CVE CVE-2014-4852 -
CVSS Base Score: 7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P
Related Vulnerabilities
- Avenger's News System Command Execution
- Apache Struts2 'URL' & 'Anchor' tags Arbitrary Java Method Execution Vulnerabilities
- ASAS Server End User Self Service (EUSS) SQL Injection Vulnerability
- Admin Bot 'news.php' SQL Injection Vulnerability
- AlienVault OSSIM Multiple Remote Code Execution Vulnerabilities