CVE-2015-2563

Vastal I-Tech phpVID 0.9.9 and 1.2.3 - SQL Injection via groups.php order_by Parameter

Title source: llm

Description

SQL injection vulnerability in groups.php in Vastal I-Tech phpVID 0.9.9 and 1.2.3 allows remote attackers to execute arbitrary SQL commands via the order_by parameter. NOTE: The cat parameter vector is already covered by CVE-2008-4157.

References (3)

Core 3

Core References

Exploit, Third Party Advisory x_refsource_misc

http://packetstormsecurity.com/files/130754/Vastal-I-tech-phpVID-1.2.3-SQL-Injection.html

Various Sources x_refsource_misc

http://tetraph.com/security/sql-injection-vulnerability/vastal-i-tech-phpvid-1-2-3-sql-injection-security-vulnerabilities/

Mailing List mailing-list x_refsource_fulldisc

http://seclists.org/fulldisclosure/2015/Mar/58

Scores

EPSS 0.0217

EPSS Percentile 80.4%

Details

CWE

CWE-89

Status published

Products (2)

vastal/phpvid 0.9.9

vastal/phpvid 1.2.3

Published Mar 20, 2015

Tracked Since Feb 18, 2026