CVE-2015-6009
HighSummary
Multiple SQL injection vulnerabilities in Web Reference Database (refbase) version 0.9.6 allow remote attackers to execute arbitrary SQL commands via the 'where' parameter in rss.php or the 'sqlQuery' parameter in search.php.
Risk Assessment
Attackers may gain access to sensitive data or compromise the integrity of the database, posing a serious threat to the organization's security.
Recommendation
It is recommended to upgrade to the latest version of refbase and implement input filtering and validation to minimize the risk of SQL injection.
Other vulnerabilities in Web Reference Database (refbase) version 0.9.6
See all- CVE-2015-7382High
SQL injection vulnerability in install.php in Web Reference Database (refbase) version 0.9.6 allows remote attackers to execute arbitrary SQL commands via the defaultCharacterSet parameter.
- CVE-2015-7381High
Multiple PHP remote file inclusion vulnerabilities in install.php in Web Reference Database (refbase) version 0.9.6 allow remote attackers to execute arbitrary PHP code via the pathToMYSQL or databaseStructureFile parameters.
- CVE-2015-6008High
The install.php file in Web Reference Database (refbase) version 0.9.6 allows remote attackers to execute arbitrary commands via the adminPassword parameter, posing a serious security risk.
Original NVD description (English source)
Multiple SQL injection vulnerabilities in Web Reference Database (aka refbase) through 0.9.6 allow remote attackers to execute arbitrary SQL commands via (1) the where parameter to rss.php or (2) the sqlQuery parameter to search.php, a different issue than CVE-2015-7382.