CVE-2015-2237

Multiple SQL injection vulnerabilities in Betster (aka PHP Betoffice) 1.0.4 allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) showprofile.php or (2) categoryedit.php or (3) username parameter in a login to index.php.
Configurations

Configuration 1 (hide)

cpe:2.3:a:betster_project:betster:1.0.4:*:*:*:*:*:*:*

History

21 Nov 2024, 02:27

Type Values Removed Values Added
References () http://packetstormsecurity.com/files/130696/Betster-1.0.4-SQL-Injection-Authentication-Bypass.html - Exploit () http://packetstormsecurity.com/files/130696/Betster-1.0.4-SQL-Injection-Authentication-Bypass.html - Exploit
References () http://www.securityfocus.com/archive/1/534816/100/0/threaded - () http://www.securityfocus.com/archive/1/534816/100/0/threaded -
References () https://www.exploit-db.com/exploits/36306/ - () https://www.exploit-db.com/exploits/36306/ -

Information

Published : 2015-03-12 17:59

Updated : 2024-11-21 02:27


NVD link : CVE-2015-2237

Mitre link : CVE-2015-2237

CVE.ORG link : CVE-2015-2237


JSON object : View

Products Affected

betster_project

  • betster
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')