Sql injection

2014-05-0200:55:00

PRIOn knowledge base

www.prio-n.com

8.6 High

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

55.2%

JSON

SQL injection vulnerability in Xerox DocuShare before 6.53 Patch 6 Hotfix 2, 6.6.1 Update 1 before Hotfix 24, and 6.6.1 Update 2 before Hotfix 3 allows remote authenticated users to execute arbitrary SQL commands via the PATH_INFO to /docushare/dsweb/ResultBackgroundJobMultiple/. NOTE: some of these details are obtained from third party information.

CPENameOperatorVersion
docushareeq6.5.3 patch6
docushareeq6.6.1 update1
docushareeq6.5.3
docushareeq6.6.1
docushareeq6.6.1 update2

Name	Operator	Version
docushare	eq	6.5.3 patch6
docushare	eq	6.6.1 update1
docushare	eq	6.5.3
docushare	eq	6.6.1
docushare	eq	6.6.1 update2

References

packetstormsecurity.com/files/126171/Xerox-DocuShare-SQL-Injection.html

seclists.org/fulldisclosure/2014/Apr/205

secunia.com/advisories/57996

www.osvdb.org/105972

www.securityfocus.com/bid/66922

www.xerox.com/download/security/security-bulletin/a72cd-4f7a54ce14460/cert_XRX14-003_V1.0.pdf

exchange.xforce.ibmcloud.com/vulnerabilities/92548

www.exploit-db.com/exploits/32886