VulnerabilityModified

CVE-2013-7139

SQL injection vulnerability in download.php in Horizon Quick Content Management System (QCMS) 4.0 and earlier allows remote to execute arbitrary SQL commands via the category parameter.

HIGH 7.5EPSS 1.02%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (1.02%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

SQL injection vulnerability in download.php in Horizon Quick Content Management System (QCMS) 4.0 and earlier allows remote to execute arbitrary SQL commands via the category parameter.

CVSS 2.0: 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS: 1.02% probability · 61th percentile
CISA KEV: Not listed
Weakness: CWE-89
Affected: cynthia fridsma/horizon quick content management system
Source: cve@mitre.org

References

http://www.securityfocus.com/bid/64715Exploit
https://www.htbridge.com/advisory/HTB23191Exploit
http://www.securityfocus.com/bid/64715Exploit
https://www.htbridge.com/advisory/HTB23191Exploit

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.