VulnerabilityModified
CVE-2014-5275
Multiple SQL injection vulnerabilities in includes/functions.php in Pro Chat Rooms Text Chat Rooms 8.2.0 allow remote authenticated users to execute arbitrary SQL commands via the (1) password, (2) email, or (3) id parameter.
MEDIUM 6.5EPSS 1.95%
Does this matter?
Lower severity and a low EPSS score (1.95%). Track it; it rarely justifies an emergency change on its own.
Description
Multiple SQL injection vulnerabilities in includes/functions.php in Pro Chat Rooms Text Chat Rooms 8.2.0 allow remote authenticated users to execute arbitrary SQL commands via the (1) password, (2) email, or (3) id parameter.
- CVSS 2.0
- 6.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
- EPSS
- 1.95% probability · 79th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-89
- Affected
- prochatrooms/text chat rooms
- Source
- cve@mitre.org
References
- http://archives.neohapsis.com/archives/bugtraq/2014-08/0026.htmlExploit
- http://packetstormsecurity.com/files/127775/Pro-Chat-Rooms-8.2.0-XSS-Shell-Upload-SQL-Injection.htmlExploit
- http://www.exploit-db.com/exploits/34275Exploit
- http://www.osvdb.org/109829
- https://exchange.xforce.ibmcloud.com/vulnerabilities/95127
- http://archives.neohapsis.com/archives/bugtraq/2014-08/0026.htmlExploit
- http://packetstormsecurity.com/files/127775/Pro-Chat-Rooms-8.2.0-XSS-Shell-Upload-SQL-Injection.htmlExploit
- http://www.exploit-db.com/exploits/34275Exploit
- http://www.osvdb.org/109829
- https://exchange.xforce.ibmcloud.com/vulnerabilities/95127
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.