CVE-2015-1428
HighSummary
Multiple SQL injection vulnerabilities in Sefrengo before version 1.6.2 allow remote attackers to execute arbitrary SQL commands via the sefrengo cookie in a login to backend/main.php or via the value_id parameter in a save_value action to backend/main.php.
Risk Assessment
These vulnerabilities could lead to unauthorized access to the database, posing a serious threat to the integrity and confidentiality of the organization's data.
Recommendation
It is recommended to update Sefrengo to version 1.6.2 or later and implement additional security measures such as input validation.
Other vulnerabilities in Sefrengo
See all- CVE-2015-0919High
Multiple SQL injection vulnerabilities in the administrative backend in Sefrengo before version 1.6.1 allow remote administrators to execute arbitrary SQL commands via the (1) idcat or (2) idclient parameter to backend/main.php.
- CVE-2015-5052Critical
CVE-2015-5052 is an SQL injection vulnerability in Sefrengo before version 1.6.5 beta2.
Original NVD description (English source)
Multiple SQL injection vulnerabilities in Sefrengo before 1.6.2 allow (1) remote attackers to execute arbitrary SQL commands via the sefrengo cookie in a login to backend/main.php or (2) remote authenticated users to execute arbitrary SQL commands via the value_id parameter in a save_value action to backend/main.php.