CVE-2014-9242
HighSummary
CVE-2014-9242 is an SQL injection vulnerability in admin/pages/modify.php in WebsiteBaker 2.8.3 that allows remote attackers to execute arbitrary SQL commands via the page_id parameter.
Risk Assessment
Attackers can exploit this vulnerability to gain unauthorized access to the database, potentially leading to data theft or system compromise.
Recommendation
It is recommended to upgrade to the latest version of WebsiteBaker and implement input filtering and validation to minimize the risk of SQL injection attacks.
Other vulnerabilities in WebsiteBaker 2.8.3
See all- CVE-2021-47788High
WebsiteBaker 2.13.0 contains an authenticated remote code execution vulnerability that allows users with language editing permissions to execute arbitrary code. Attackers can exploit the language installation endpoint by manipulating language installation parameters to achieve remote code execution on the server.
- CVE-2017-9771Critical
The install/save.php file in WebsiteBaker version 2.10.0 has a vulnerability that allows remote attackers to execute arbitrary PHP code via the database_username, database_host, or database_password parameters.
- CVE-2017-9360Critical
WebsiteBaker v2.10.0 has a SQL injection vulnerability in /account/details.php.
Original NVD description (English source)
SQL injection vulnerability in admin/pages/modify.php in WebsiteBaker 2.8.3 allows remote attackers to execute arbitrary SQL commands via the page_id parameter.