Description

SQL injection vulnerability in blogs/admin.php in b2evolution before 4.1.7 allows remote authenticated administrators to execute arbitrary SQL commands via the show_statuses[] parameter. NOTE: this can be leveraged using CSRF to allow remote unauthenticated attackers to execute arbitrary SQL commands.

Remediation

References

CVE-2013-2945

Related Vulnerabilities

ProjectSend Use of Insufficiently Random Values Vulnerability (CVE-2024-7659)

MediaWiki Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-30157)

Joomla Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2011-1151)

e107 Other Vulnerability (CVE-2005-2327)

WebLogic CVE-2016-3499 Vulnerability (CVE-2016-3499)

Severity

Medium

Classification

CVE-2013-2945 CWE-138

Tags

Missing Update Known Vulnerabilities