CVE-2015-1442

ZeroCMS <= 1.3.3 - Authenticated SQL Injection via user_id Parameter

Title source: llm

Description

SQL injection vulnerability in views/zero_transact_user.php in the administrative backend in ZeroCMS 1.3.3, 1.3.2, and earlier allows remote authenticated users to execute arbitrary SQL commands via the user_id parameter in a Modify Account action. NOTE: The article_id parameter to zero_view_article.php vector is already covered by CVE-2014-4034.

References (8)

Core 8

Core References

Exploit x_refsource_misc

http://packetstormsecurity.com/files/130192/ZeroCMS-1.3.3-SQL-Injection.html

Exploit mailing-list x_refsource_mlist

http://seclists.org/oss-sec/2015/q1/379

Exploit x_refsource_misc

http://sroesemann.blogspot.de/2015/01/report-for-advisory-sroeadv-2015-14.html

Exploit x_refsource_misc

http://sroesemann.blogspot.de/2015/01/sroeadv-2015-13.html

Mailing List mailing-list x_refsource_mlist

http://seclists.org/oss-sec/2015/q1/380

Exploit mailing-list x_refsource_fulldisc

http://seclists.org/fulldisclosure/2015/Feb/4

Exploit x_refsource_misc

http://sroesemann.blogspot.de/2015/02/addition-for-advisory-sroeadv-2015-14.html

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/72398

Scores

EPSS 0.0237

EPSS Percentile 82.0%

Details

CWE

CWE-89

Status published

Products (2)

aas9/zerocms 1.3.2

aas9/zerocms < 1.3.3

Published Feb 06, 2015

Tracked Since Feb 18, 2026