VulnerabilityModified
CVE-2013-5028
SQL injection vulnerability in IT/hardware-list.dll in Kwoksys Kwok Information Server before 2.8.5 allows remote authenticated users to execute arbitrary SQL commands via the (1) hardwareType, (2) hardwareStatus, or (3) hardwareLocation parameter in a…
MEDIUM 6.5EPSS 1.95%
Does this matter?
Lower severity and a low EPSS score (1.95%). Track it; it rarely justifies an emergency change on its own.
Description
SQL injection vulnerability in IT/hardware-list.dll in Kwoksys Kwok Information Server before 2.8.5 allows remote authenticated users to execute arbitrary SQL commands via the (1) hardwareType, (2) hardwareStatus, or (3) hardwareLocation parameter in a search command.
- CVSS 2.0
- 6.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
- EPSS
- 1.95% probability · 79th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-89
- Affected
- kwoksys/information server
- Source
- cve@mitre.org
References
- http://packetstormsecurity.com/files/123193Exploit
- http://www.kwoksys.com/wiki/index.php?title=Release_Notes
- https://exchange.xforce.ibmcloud.com/vulnerabilities/86363
- https://exchange.xforce.ibmcloud.com/vulnerabilities/87067
- http://packetstormsecurity.com/files/123193Exploit
- http://www.kwoksys.com/wiki/index.php?title=Release_Notes
- https://exchange.xforce.ibmcloud.com/vulnerabilities/86363
- https://exchange.xforce.ibmcloud.com/vulnerabilities/87067
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.