CVE-2017-15378
HighSummary
SQL Injection exists in the E-Sic 1.0 password reset parameter (aka the cpfcnpj parameter to the /reset URI).
Risk Assessment
An attacker could exploit this vulnerability to gain unauthorized access to the database, potentially leading to the exposure of sensitive information.
Recommendation
It is recommended to validate and sanitize input data in the cpfcnpj parameter and to update to the latest version of the software to mitigate the risk.
Other vulnerabilities in E-Sic 1.0
See all- CVE-2017-15381Critical
SQL Injection exists in E-Sic 1.0 via the f parameter to the zip code search script (buscacep.php).
- CVE-2017-15379Critical
An authentication bypass exists in E-Sic 1.0 via '=' or 'or' values for the username and password in the /index (login) URI.
- CVE-2017-15373Critical
E-Sic version 1.0 allows SQL injection via the q parameter in the esiclivre/restrito/inc/lkpcep.php file, which is part of the private search area.
Original NVD description (English source)
SQL Injection exists in the E-Sic 1.0 password reset parameter (aka the cpfcnpj parameter to the /reset URI).