CVE-2014-2211

POSH <3.3.0 - SQL Injection

Title source: llm
STIX 2.1

Description

SQL injection vulnerability in portal/addtoapplication.php in POSH (aka Posh portal or Portaneo) 3.0 before 3.3.0 allows remote attackers to execute arbitrary SQL commands via the rssurl parameter.

Exploits (1)

exploitdb WORKING POC VERIFIED
by Anthony BAUBE · textwebappsphp
https://www.exploit-db.com/exploits/39108

References (5)

Core 5
Core References
Exploit, Patch x_refsource_misc
http://www.sysdream.com/CVE-2014-2211_2214
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/65817
Product x_refsource_confirm
http://sourceforge.net/p/posh/svn/3540/
Mailing List mailing-list x_refsource_mlist
http://seclists.org/oss-sec/2014/q1/444

Scores

EPSS 0.0029
EPSS Percentile 52.1%

Details

CWE
CWE-89
Status published
Products (9)
posh_project/posh 3.0
posh_project/posh 3.0.1
posh_project/posh 3.0.2
posh_project/posh 3.0.3
posh_project/posh 3.0.4
posh_project/posh 3.1.0
posh_project/posh 3.1.1
posh_project/posh 3.1.2
posh_project/posh < 3.2.1
Published Mar 03, 2014
Tracked Since Feb 18, 2026