CVE-2017-9848
CRITICALEasysite 7.0 - SQL Injection via GetArticleHitsArray XML ArticleIDs Element
Title source: llmDescription
SQL injection vulnerability in C_InfoService.asmx in WebServices in Easysite 7.0 could allow remote attackers to execute arbitrary SQL commands via an XML document containing a crafted ArticleIDs element within a GetArticleHitsArray element.
References (3)
Core 3
Core References
Issue Tracking x_refsource_misc
https://github.com/Akityo/TOPSEC/issues/1
Third Party Advisory x_refsource_misc
http://www.2cto.com/article/201409/338712.html
Various Sources x_refsource_confirm
http://www.huilan.com/zkhl/resource/cms/2015/09/2015091814311792443.pdf
Scores
CVSS v3
9.8
EPSS
0.0141
EPSS Percentile
69.8%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-89
Status
published
Products (1)
easysitecms/easysite
7.0.0
Published
Jun 24, 2017
Tracked Since
Feb 18, 2026