Summary
This host is running CiviCRM and is prone to SQL injection vulnerability.
Impact
Successful exploitation will allow remote attackers to execute arbitrary SQL commands in applications database and gain complete control over the vulnerable web application.
Impact Level: Application
Solution
Upgrade to CiviCRM version 4.2.12 or 4.3.7 or 4.4.beta4 or later.
Insight
The flaw is due to insufficient validation of '_value' HTTP GET parameter passed to '/Location.php' script.
Affected
CiviCRM versions 4.2.x before 4.2.12, 4.3.x before 4.3.7, and 4.4.x before 4.4.beta4.
Detection
Send a crafted exploit string via HTTP GET request and check whether it is possible to execute sql query.
References
Severity
Classification
-
CVE CVE-2013-5957 -
CVSS Base Score: 7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P
Related Vulnerabilities