CVE-2017-14145
CriticalSummary
HelpDEZk version 1.1.1 has an SQL Injection vulnerability in the loginController.php file, occurring in the selectWarning function. This issue is related to the admin/login/getWarningInfo/id/ PATH_INFO.
Risk Assessment
Exploitation of this vulnerability may lead to unauthorized access to the database, potentially resulting in the disclosure of sensitive information or data manipulation.
Recommendation
It is recommended to update HelpDEZk to the latest version to eliminate this vulnerability and conduct a security audit of the application.
Other vulnerabilities in HelpDEZk 1.1.1
See all- CVE-2017-14146High
HelpDEZk version 1.1.1 allows remote authenticated users to execute arbitrary PHP code by uploading a .php attachment and then requesting it in the helpdezk\app\uploads\helpdezk\attachments\ directory.
- CVE-2017-7447High
HelpDEZk version 1.1.1 has a CSRF vulnerability in admin/home#/logos/, which can lead to remote execution of arbitrary PHP code.
- CVE-2017-7446High
HelpDEZk version 1.1.1 has a CSRF vulnerability in the path admin/home#/person/, allowing for the acquisition of admin privileges.
Original NVD description (English source)
HelpDEZk 1.1.1 has SQL Injection in app\modules\admin\controllers\loginController.php via the admin/login/getWarningInfo/id/ PATH_INFO, related to the selectWarning function.