packetstormsecurity.org
http://packetstormsecurity.org/1002-exploits/corelan-10-008-evalmsi.txt CVE-2010-0614
evalSMSI 2.1.3 - Multiple Input Validation Vulnerabilities
Record summary
CVE-2010-0614 has a selected CVSS score of 7.5; EIP currently links 1 catalogued exploit.
Description
SQL injection vulnerability in ajax.php in evalSMSI 2.1.03 allows remote attackers to execute arbitrary SQL commands via the query parameter in the (1) question action, and possibly the (2) sub_par or (3) num_quest actions.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
Proofs of concept
1Catalogued exploits
ExploitDBevalSMSI 2.1.3 - Multiple Input Validation VulnerabilitiesExploitDB exploitby ekseNot analyzed1 file
References
838478Third-party advisory
http://secunia.com/advisories/38478 corelan.be
http://www.corelan.be:8800/index.php/forum/security-advisories/corelan-10-008-evalmsi-2-1-03-multiple-vulnerabilities 62177vdb entry
http://www.osvdb.org/62177 20100204 CORELAN-10-008 - Multiple vulnerabilities found in evalmsi 2.1.03mailing list
http://www.securityfocus.com/archive/1/509370/100/0/threaded 38116vdb entry
http://www.securityfocus.com/bid/38116 evalsmsi-ajax-sql-injection(56152)vdb entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/56152 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2010-0614