packetstormsecurity.com
http://packetstormsecurity.com/files/129440/Humhub-0.10.0-rc.1-Cross-Site-Scripting-SQL-Injection.html CVE-2014-9528
Humhub 0.10.0-rc.1 - SQL Injection
Record summary
CVE-2014-9528 has a selected CVSS score of 7.5; EIP currently links 1 catalogued exploit.
Description
SQL injection vulnerability in the actionIndex function in protected/modules_core/notification/controllers/ListController.php in HumHub 0.10.0-rc.1 and earlier allows remote authenticated users to execute arbitrary SQL commands via the from parameter to index.php. NOTE: this can be leveraged for cross-site scripting (XSS) attacks via a request that causes an error.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
Proofs of concept
1Catalogued exploits
ExploitDBHumhub 0.10.0-rc.1 - SQL InjectionExploitDB exploitby Jos Wetzels_ Emiel FlorijnNot analyzed1 file
References
620141209 Humhub SQL injection and multiple persistent XSS vulnerabilitiesmailing list
http://seclists.org/fulldisclosure/2014/Dec/31 35510exploit
http://www.exploit-db.com/exploits/35510 humhub-listcontroller-sql-injection(99272)vdb entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/99272 github.comConfirmation
https://github.com/humhub/humhub/commit/febb89ab823d0bd6246c6cf460addabb6d7a01d4 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2014-9528