CVE-2019-8979

CRITICAL LAB

Kohana < 3.3.6 - SQL Injection

Title source: rule

Kohana through 3.3.6 has SQL Injection when the order_by() parameter can be controlled.

nomisec WORKING POC 2 stars

by elttam · poc

CVSS v3 9.8

EPSS 0.0841

EPSS Percentile 92.3%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

COMMUNITY

Community Lab

docker pull mysql:5.7

View in Library

CWE

CWE-89

Status published

Products (1)

kohanaframework/kohana < 3.3.6

Published Feb 21, 2019

Tracked Since Feb 18, 2026