Join our subscribers
SQL Injection Vulnerability in TomatoCMS
| Advisory ID: | HTB22444 |
| Product: | TomatoCMS |
| Vendor: | TomatoCMS |
| Vulnerable Versions: | 2.0.6 and probably prior |
| Tested Version: | 2.0.6 |
| Advisory Publication: | June 14, 2010 [without technical details] |
| Vendor Notification: | June 14, 2010 |
| Public Disclosure: | June 28, 2010 |
| Vulnerability Type: | SQL Injection [CWE-89] |
| Risk Level: | High |
 | |
| CVSSv2 Base Score: | 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P) |
| Solution Status: | Fixed by Vendor |
| Discovered and Provided: | High-Tech Bridge Security Research Lab |
| Advisory Details: | |
High-Tech Bridge SA Security Research Lab has discovered vulnerability in TomatoCMS which could be exploited to execute arbitrary SQL commands in application`s database. | |
| Solution: | |
| Upgrade to the most recent version | |
References: | |
| [1] High-Tech Bridge Advisory HTB22444 - https://www.immuniweb.com/advisory/HTB22444 - SQL Injection Vulnerability in TomatoCMS [2] TomatoCMS - tomatocms.com - TomatoCMS is an open source content management system powered by Zend Framework, jQuery and 960 Grid System. [3] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types. | |
Please feel free to send us any additional information related to this Advisory, such as vulnerable versions, additional exploitation details and conditions, patches and other relevant details.
