CVE-2017-15373

Critical

Published: 16/10/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

E-Sic version 1.0 allows SQL injection via the q parameter in the esiclivre/restrito/inc/lkpcep.php file, which is part of the private search area.

Risk Assessment

An attacker could exploit this vulnerability to gain unauthorized access to the database, potentially leading to the disclosure of sensitive information.

Recommendation

It is recommended to upgrade to the latest version of E-Sic and implement input filtering and validation to prevent SQL injection attacks.

Original NVD description (English source)

E-Sic 1.0 allows SQL injection via the q parameter to esiclivre/restrito/inc/lkpcep.php (aka the search private area).