CVE-2017-15381
CriticalSummary
SQL Injection exists in E-Sic 1.0 via the f parameter to the zip code search script (buscacep.php).
Risk Assessment
An attacker could exploit this vulnerability to gain unauthorized access to the database, potentially leading to the disclosure of sensitive information.
Recommendation
It is recommended to update to the latest version of E-Sic and implement input filtering and validation in the application.
Other vulnerabilities in E-Sic 1.0
See all- CVE-2017-15378High
SQL Injection exists in the E-Sic 1.0 password reset parameter (aka the cpfcnpj parameter to the /reset URI).
- CVE-2017-15379Critical
An authentication bypass exists in E-Sic 1.0 via '=' or 'or' values for the username and password in the /index (login) URI.
- CVE-2017-15373Critical
E-Sic version 1.0 allows SQL injection via the q parameter in the esiclivre/restrito/inc/lkpcep.php file, which is part of the private search area.
Original NVD description (English source)
SQL Injection exists in E-Sic 1.0 via the f parameter to esiclivre/restrito/inc/buscacep.php (aka the zip code search script).