CVE-2017-9360
CriticalSummary
WebsiteBaker v2.10.0 has a SQL injection vulnerability in /account/details.php.
Risk Assessment
An attacker could exploit this vulnerability to gain unauthorized access to the database, potentially leading to the disclosure of sensitive information.
Recommendation
It is recommended to update to the latest version of WebsiteBaker and to secure the application against SQL injection.
Other vulnerabilities in WebsiteBaker v2.10.0
See all- CVE-2021-47788High
WebsiteBaker 2.13.0 contains an authenticated remote code execution vulnerability that allows users with language editing permissions to execute arbitrary code. Attackers can exploit the language installation endpoint by manipulating language installation parameters to achieve remote code execution on the server.
- CVE-2014-9242High
CVE-2014-9242 is an SQL injection vulnerability in admin/pages/modify.php in WebsiteBaker 2.8.3 that allows remote attackers to execute arbitrary SQL commands via the page_id parameter.
- CVE-2017-9771Critical
The install/save.php file in WebsiteBaker version 2.10.0 has a vulnerability that allows remote attackers to execute arbitrary PHP code via the database_username, database_host, or database_password parameters.
Original NVD description (English source)
WebsiteBaker v2.10.0 has a SQL injection vulnerability in /account/details.php.