CVE-2015-2563

SQL injection vulnerability in groups.php in Vastal I-Tech phpVID 0.9.9 and 1.2.3 allows remote attackers to execute arbitrary SQL commands via the order_by parameter. NOTE: The cat parameter vector is already covered by CVE-2008-4157.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:vastal:phpvid:0.9.9:*:*:*:*:*:*:*
cpe:2.3:a:vastal:phpvid:1.2.3:*:*:*:*:*:*:*

History

21 Nov 2024, 02:27

Type Values Removed Values Added
References () http://packetstormsecurity.com/files/130754/Vastal-I-tech-phpVID-1.2.3-SQL-Injection.html - () http://packetstormsecurity.com/files/130754/Vastal-I-tech-phpVID-1.2.3-SQL-Injection.html -
References () http://seclists.org/fulldisclosure/2015/Mar/58 - () http://seclists.org/fulldisclosure/2015/Mar/58 -
References () http://tetraph.com/security/sql-injection-vulnerability/vastal-i-tech-phpvid-1-2-3-sql-injection-security-vulnerabilities/ - () http://tetraph.com/security/sql-injection-vulnerability/vastal-i-tech-phpvid-1-2-3-sql-injection-security-vulnerabilities/ -

Information

Published : 2015-03-20 14:59

Updated : 2024-11-21 02:27


NVD link : CVE-2015-2563

Mitre link : CVE-2015-2563

CVE.ORG link : CVE-2015-2563


JSON object : View

Products Affected

vastal

  • phpvid
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')