CVE-2015-6008
HighSummary
The install.php file in Web Reference Database (refbase) version 0.9.6 allows remote attackers to execute arbitrary commands via the adminPassword parameter, posing a serious security risk.
Risk Assessment
Exploitation of this vulnerability could lead to remote attackers gaining control over the system, posing significant risks to data integrity and confidentiality.
Recommendation
It is recommended to upgrade to the latest version of refbase and implement additional security measures to restrict access to critical parameters.
Other vulnerabilities in Web Reference Database (refbase) version 0.9.6
See all- CVE-2015-7382High
SQL injection vulnerability in install.php in Web Reference Database (refbase) version 0.9.6 allows remote attackers to execute arbitrary SQL commands via the defaultCharacterSet parameter.
- CVE-2015-7381High
Multiple PHP remote file inclusion vulnerabilities in install.php in Web Reference Database (refbase) version 0.9.6 allow remote attackers to execute arbitrary PHP code via the pathToMYSQL or databaseStructureFile parameters.
- CVE-2015-6009High
Multiple SQL injection vulnerabilities in Web Reference Database (refbase) version 0.9.6 allow remote attackers to execute arbitrary SQL commands via the 'where' parameter in rss.php or the 'sqlQuery' parameter in search.php.
Original NVD description (English source)
install.php in Web Reference Database (aka refbase) through 0.9.6 allows remote attackers to execute arbitrary commands via the adminPassword parameter, a different issue than CVE-2015-7381.