CVE-2017-15875

Critical

Published: 19/12/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

CVE-2017-15875 is a SQL injection vulnerability in the Password Recovery feature in GPWeb 8.4.61. It allows remote attackers to execute arbitrary SQL commands via the 'checkemail' parameter.

Risk Assessment

Attackers can exploit this vulnerability to gain access to sensitive data in the database, potentially leading to serious security breaches for the organization.

Recommendation

It is recommended to update to the latest version of GPWeb to mitigate this vulnerability and implement additional security measures against SQL injection.

Original NVD description (English source)

SQL injection vulnerability in Password Recovery in GPWeb 8.4.61 allows remote attackers to execute arbitrary SQL commands via the "checkemail" parameter.