FileRun (version 2017.09.18 and below) suffers from a remote SQL injection vulnerability due to a failure to sanitize input in the metafield parameter inside the metasearch module (under the search function).
References
| Link | Resource |
|---|---|
| http://feedback.filerun.com/topics/189-critical-security-update-available/ | Patch Vendor Advisory |
| https://blog.spentera.com/2017/09/29/blind-sql-injection-vulnerability-in-filerun-2017-09-18/ | Exploit Third Party Advisory |
| https://www.exploit-db.com/exploits/42922/ | Exploit Third Party Advisory VDB Entry |
| http://feedback.filerun.com/topics/189-critical-security-update-available/ | Patch Vendor Advisory |
| https://blog.spentera.com/2017/09/29/blind-sql-injection-vulnerability-in-filerun-2017-09-18/ | Exploit Third Party Advisory |
| https://www.exploit-db.com/exploits/42922/ | Exploit Third Party Advisory VDB Entry |
Configurations
History
21 Nov 2024, 03:13
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://feedback.filerun.com/topics/189-critical-security-update-available/ - Patch, Vendor Advisory | |
| References | () https://blog.spentera.com/2017/09/29/blind-sql-injection-vulnerability-in-filerun-2017-09-18/ - Exploit, Third Party Advisory | |
| References | () https://www.exploit-db.com/exploits/42922/ - Exploit, Third Party Advisory, VDB Entry |
Information
Published : 2017-09-30 01:29
Updated : 2024-11-21 03:13
NVD link : CVE-2017-14738
Mitre link : CVE-2017-14738
CVE.ORG link : CVE-2017-14738
JSON object : View
Products Affected
filerun
- filerun
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')