CVE-2017-15875

Critical

Published: 19/12/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

CVE-2017-15875 is a SQL injection vulnerability in the Password Recovery feature in GPWeb 8.4.61. It allows remote attackers to execute arbitrary SQL commands via the 'checkemail' parameter.

Risk Assessment

Attackers can exploit this vulnerability to gain access to sensitive data in the database, potentially leading to serious security breaches for the organization.

Recommendation

It is recommended to update to the latest version of GPWeb to mitigate this vulnerability and implement additional security measures against SQL injection.

Other vulnerabilities in GPWeb 8.4.61

See all

CVE-2017-15876High
Unrestricted File Upload vulnerability in GPWeb 8.4.61 allows remote authenticated users to upload any type of file, including a PHP shell.
CVE-2017-15877Critical
The CVE-2017-15877 vulnerability in the db.php file in GPWeb 8.4.61 has insecure permissions that allow remote attackers to view the password and user database.

Original NVD description (English source)

SQL injection vulnerability in Password Recovery in GPWeb 8.4.61 allows remote attackers to execute arbitrary SQL commands via the "checkemail" parameter.