VulnerabilityModified
CVE-2015-7568
SQL injection vulnerability in the password recovery feature in Yeager CMS 1.2.1 allows remote attackers to change the account credentials of known users via the "userEmail" parameter.
CRITICAL 9.8EPSS 4.06%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (4.06%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
SQL injection vulnerability in the password recovery feature in Yeager CMS 1.2.1 allows remote attackers to change the account credentials of known users via the "userEmail" parameter.
- CVSS 3.0
- 9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 4.06% probability · 90th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-89
- Affected
- yeager/yeager cms
- Source
- secalert@redhat.com
References
- http://packetstormsecurity.com/files/135716/Yeager-CMS-1.2.1-File-Upload-SQL-Injection-XSS-SSRF.htmlExploit, Patch, Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2016/Feb/44Mailing List, Patch, Third Party Advisory
- http://www.securityfocus.com/archive/1/537493/100/0/threadedExploit, Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/39436/Exploit, Patch, Third Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/135716/Yeager-CMS-1.2.1-File-Upload-SQL-Injection-XSS-SSRF.htmlExploit, Patch, Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2016/Feb/44Mailing List, Patch, Third Party Advisory
- http://www.securityfocus.com/archive/1/537493/100/0/threadedExploit, Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/39436/Exploit, Patch, Third Party Advisory, VDB Entry
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.