CVE-2015-0919
HighSummary
Multiple SQL injection vulnerabilities in the administrative backend in Sefrengo before version 1.6.1 allow remote administrators to execute arbitrary SQL commands via the (1) idcat or (2) idclient parameter to backend/main.php.
Risk Assessment
These vulnerabilities could lead to unauthorized access to the database and data manipulation, posing a serious threat to the integrity and confidentiality of information within the organization.
Recommendation
It is recommended to update Sefrengo to version 1.6.1 or later and implement additional security measures such as input data filtering.
Other vulnerabilities in Sefrengo
See all- CVE-2015-1428High
Multiple SQL injection vulnerabilities in Sefrengo before version 1.6.2 allow remote attackers to execute arbitrary SQL commands via the sefrengo cookie in a login to backend/main.php or via the value_id parameter in a save_value action to backend/main.php.
- CVE-2015-5052Critical
CVE-2015-5052 is an SQL injection vulnerability in Sefrengo before version 1.6.5 beta2.
Original NVD description (English source)
Multiple SQL injection vulnerabilities in the administrative backend in Sefrengo before 1.6.1 allow remote administrators to execute arbitrary SQL commands via the (1) idcat or (2) idclient parameter to backend/main.php.