Exploitation Summary
EIP tracks 1 public exploit for CVE-2014-4170. PoCs published by High-Tech Bridge SA.
AI-analyzed exploit summary The advisory describes an improper access control vulnerability in ArticleFR (CVE-2014-4170) allowing arbitrary UPDATE SQL statements via the /data.php script. Exploitation requires no authentication and can grant administrative privileges by manipulating database records.
Description
A Privilege Escalation Vulnerability exists in Free Reprintables ArticleFR 11.06.2014 due to insufficient access restrictions in the data.php script, which could let a remote malicious user obtain access or modify or delete database information.
Exploits (1)
The advisory describes an improper access control vulnerability in ArticleFR (CVE-2014-4170) allowing arbitrary UPDATE SQL statements via the /data.php script. Exploitation requires no authentication and can grant administrative privileges by manipulating database records.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H