CVE-2017-20195

MEDIUM

LUNAD3v AreaLoad - SQL Injection via Phone Parameter in request.php

Title source: llm

Description

A vulnerability was found in LUNAD3v AreaLoad up to 1a1103182ed63a06dde63d1712f3262eda19c3ec. It has been rated as critical. This issue affects some unknown processing of the file request.php. The manipulation of the argument phone leads to sql injection. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The patch is named 264813c546dba03989ac0fc365f2022bf65e3be2. It is recommended to apply a patch to fix this issue.

References (3)

Core 3

Core References

Permissions Required, VDB Entry vdb-entry technical-description

https://vuldb.com/?id.281987

Permissions Required, VDB Entry signature permissions-required

https://vuldb.com/?ctiid.281987

Patch patch

https://github.com/LUNAD3v/areaload/commit/264813c546dba03989ac0fc365f2022bf65e3be2

Scores

CVSS v3 5.5

EPSS 0.0029

EPSS Percentile 21.3%

Attack Vector ADJACENT_NETWORK

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-89

Status published

Products (1)

LUNAD3v/AreaLoad 1a1103182ed63a06dde63d1712f3262eda19c3ec

Published Oct 29, 2024

Tracked Since Feb 18, 2026