Lucene search

MitreCVE-2015-2183

HistoryMar 10, 2015 - 2:59 p.m.

CVE-2015-2183

2015-03-1014:59:06

CWE-89

mitre

web.nvd.nist.gov

sql injection

zeuscart

security vulnerability

cve-2015-2183

admin backend

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

AI Score

8.7

Confidence

Low

EPSS

0.013

Percentile

85.9%

JSON

Multiple SQL injection vulnerabilities in the administrative backend in ZeusCart 4 allow remote administrators to execute arbitrary SQL commands via the id parameter in a (1) disporders detail or (2) subadminmgt edit action or (3) cid parameter in an editcurrency action to admin/.

Affected configurations

Nvd

Node

zeuscartzeuscartMatch4.0

VendorProductVersionCPE
zeuscartzeuscart4.0cpe:2.3:a:zeuscart:zeuscart:4.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
zeuscart	zeuscart	4.0	cpe:2.3:a:zeuscart:zeuscart:4.0:::::::*

References

packetstormsecurity.com/files/130487/Zeuscart-4-Cross-Site-Scripting-SQL-Injection.html

seclists.org/fulldisclosure/2015/Feb/89

seclists.org/oss-sec/2015/q1/649

seclists.org/oss-sec/2015/q1/727

sroesemann.blogspot.de/2015/01/sroeadv-2015-12.html

www.exploit-db.com/exploits/36159

www.securityfocus.com/bid/72761

github.com/ZeusCart/zeuscart/issues/28

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

AI Score

8.7

Confidence

Low

EPSS

0.013

Percentile

85.9%

JSON

Related for CVE-2015-2183