CVE-2014-4034

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2014-4034
SQL injection vulnerability in zero_view_article.php in ZeroCMS 1.0 allows remote attackers to execute arbitrary SQL commands via the article_id parameter.

7.5 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://packetstormsecurity.com/files/127005/ZeroCMS-1.0-SQL-Injection.html Exploit Third Party Advisory VDB Entry
http://packetstormsecurity.com/files/130192/ZeroCMS-1.3.3-SQL-Injection.html Exploit Third Party Advisory VDB Entry
http://seclists.org/fulldisclosure/2015/Feb/4 Mailing List Third Party Advisory
http://seclists.org/oss-sec/2015/q1/379 Mailing List Third Party Advisory
http://seclists.org/oss-sec/2015/q1/380 Mailing List Third Party Advisory
http://secunia.com/advisories/59182
http://sroesemann.blogspot.de/2015/01/report-for-advisory-sroeadv-2015-14.html Not Applicable
http://sroesemann.blogspot.de/2015/01/sroeadv-2015-13.html Not Applicable
http://sroesemann.blogspot.de/2015/02/addition-for-advisory-sroeadv-2015-14.html Not Applicable
http://www.exploit-db.com/exploits/33702 Exploit Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/67953 Not Applicable VDB Entry
http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5186.php Exploit Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/100588
http://packetstormsecurity.com/files/127005/ZeroCMS-1.0-SQL-Injection.html Exploit Third Party Advisory VDB Entry
http://packetstormsecurity.com/files/130192/ZeroCMS-1.3.3-SQL-Injection.html Exploit Third Party Advisory VDB Entry
http://seclists.org/fulldisclosure/2015/Feb/4 Mailing List Third Party Advisory
http://seclists.org/oss-sec/2015/q1/379 Mailing List Third Party Advisory
http://seclists.org/oss-sec/2015/q1/380 Mailing List Third Party Advisory
http://secunia.com/advisories/59182
http://sroesemann.blogspot.de/2015/01/report-for-advisory-sroeadv-2015-14.html Not Applicable
http://sroesemann.blogspot.de/2015/01/sroeadv-2015-13.html Not Applicable
http://sroesemann.blogspot.de/2015/02/addition-for-advisory-sroeadv-2015-14.html Not Applicable
http://www.exploit-db.com/exploits/33702 Exploit Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/67953 Not Applicable VDB Entry
http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5186.php Exploit Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/100588
Configurations

Configuration 1 (hide)

cpe:2.3:a:aas9:zerocms:1.0:*:*:*:*:*:*:*
History

21 Nov 2024, 02:09

Type Values Removed Values Added
References () http://packetstormsecurity.com/files/127005/ZeroCMS-1.0-SQL-Injection.html - Exploit, Third Party Advisory, VDB Entry () http://packetstormsecurity.com/files/127005/ZeroCMS-1.0-SQL-Injection.html - Exploit, Third Party Advisory, VDB Entry
References () http://packetstormsecurity.com/files/130192/ZeroCMS-1.3.3-SQL-Injection.html - Exploit, Third Party Advisory, VDB Entry () http://packetstormsecurity.com/files/130192/ZeroCMS-1.3.3-SQL-Injection.html - Exploit, Third Party Advisory, VDB Entry
References () http://seclists.org/fulldisclosure/2015/Feb/4 - Mailing List, Third Party Advisory () http://seclists.org/fulldisclosure/2015/Feb/4 - Mailing List, Third Party Advisory
References () http://seclists.org/oss-sec/2015/q1/379 - Mailing List, Third Party Advisory () http://seclists.org/oss-sec/2015/q1/379 - Mailing List, Third Party Advisory
References () http://seclists.org/oss-sec/2015/q1/380 - Mailing List, Third Party Advisory () http://seclists.org/oss-sec/2015/q1/380 - Mailing List, Third Party Advisory
References () http://secunia.com/advisories/59182 - () http://secunia.com/advisories/59182 -
References () http://sroesemann.blogspot.de/2015/01/report-for-advisory-sroeadv-2015-14.html - Not Applicable () http://sroesemann.blogspot.de/2015/01/report-for-advisory-sroeadv-2015-14.html - Not Applicable
References () http://sroesemann.blogspot.de/2015/01/sroeadv-2015-13.html - Not Applicable () http://sroesemann.blogspot.de/2015/01/sroeadv-2015-13.html - Not Applicable
References () http://sroesemann.blogspot.de/2015/02/addition-for-advisory-sroeadv-2015-14.html - Not Applicable () http://sroesemann.blogspot.de/2015/02/addition-for-advisory-sroeadv-2015-14.html - Not Applicable
References () http://www.exploit-db.com/exploits/33702 - Exploit, Third Party Advisory, VDB Entry () http://www.exploit-db.com/exploits/33702 - Exploit, Third Party Advisory, VDB Entry
References () http://www.securityfocus.com/bid/67953 - Not Applicable, VDB Entry () http://www.securityfocus.com/bid/67953 - Not Applicable, VDB Entry
References () http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5186.php - Exploit, Third Party Advisory () http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5186.php - Exploit, Third Party Advisory
References () https://exchange.xforce.ibmcloud.com/vulnerabilities/100588 - () https://exchange.xforce.ibmcloud.com/vulnerabilities/100588 -
Information

Published : 2014-06-11 14:55

Updated : 2024-11-21 02:09

NVD link : CVE-2014-4034

Mitre link : CVE-2014-4034

CVE.ORG link : CVE-2014-4034

JSON object : View

Products Affected

aas9

  • zerocms
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')