CVE-2017-9848

Critical

Published: 24/06/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

CVE-2017-9848 is a SQL injection vulnerability in C_InfoService.asmx in WebServices in Easysite 7.0. It allows remote attackers to execute arbitrary SQL commands via a crafted ArticleIDs element within an XML document in a GetArticleHitsArray element.

Risk Assessment

This vulnerability could lead to unauthorized access to the database, potentially resulting in data leakage or modification. Organizations should be aware of the risks associated with SQL injection attacks.

Recommendation

It is recommended to update Easysite to the latest version that addresses this vulnerability. Additionally, implementing security measures against SQL injection attacks, such as input validation, is advisable.

Original NVD description (English source)

SQL injection vulnerability in C_InfoService.asmx in WebServices in Easysite 7.0 could allow remote attackers to execute arbitrary SQL commands via an XML document containing a crafted ArticleIDs element within a GetArticleHitsArray element.