Description
Multiple SQL injection vulnerabilities in the orion.extfeedbackform module before 2.1.3 for Bitrix allow remote authenticated users to execute arbitrary SQL commands via the (1) order or (2) "by" parameter to admin/orion.extfeedbackform_efbf_forms.php.
References (2)
Core 2
Core References
Third Party Advisory, VDB Entry mailing-list
x_refsource_bugtraq
http://www.securityfocus.com/archive/1/537130/100/0/threaded
Exploit, Third Party Advisory x_refsource_misc
https://www.htbridge.com/advisory/HTB23280
Scores
CVSS v3
8.8
EPSS
0.0174
EPSS Percentile
75.4%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-89
Status
published
Products (1)
orion-soft/bitrix
< 2.1.2
Published
Aug 24, 2017
Tracked Since
Feb 18, 2026