CVE-2014-1619

Cubic CMS <5.2 - SQL Injection

Title source: llm
STIX 2.1

Description

Multiple SQL injection vulnerabilities in Cubic CMS 5.1.1, 5.1.2, and 5.2 allow remote attackers to execute arbitrary SQL commands via the (1) resource_id or (2) version_id parameter to recursos/agent.php or (3) login or (4) pass parameter to login.usuario.

Exploits (1)

exploitdb WRITEUP
by Eugenio Delfa · textwebappsphp
https://www.exploit-db.com/exploits/30790

References (5)

Core 5
Core References
Various Sources x_refsource_confirm
http://www.cubicfactory.com/es/cubic-cms/changelog/id/260
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/101721
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/101719
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/90153

Scores

EPSS 0.0062
EPSS Percentile 70.1%

Details

CWE
CWE-89
Status published
Products (3)
cubicfactory/cubic_cms 5.1.1
cubicfactory/cubic_cms 5.1.2
cubicfactory/cubic_cms 5.2
Published Jan 21, 2014
Tracked Since Feb 18, 2026