Join our subscribers
SQL Injection Vulnerability in ArticleFR
| Advisory ID: | HTB23225 |
| Product: | ArticleFR |
| Vendor: | Free Reprintables |
| Vulnerable Versions: | 3.0.4 and probably prior |
| Tested Version: | 3.0.4 |
| Advisory Publication: | July 23, 2014 [without technical details] |
| Vendor Notification: | July 23, 2014 |
| Public Disclosure: | August 20, 2014 |
| Latest Update: | August 20, 2014 |
| Vulnerability Type: | SQL Injection [CWE-89] |
| CVE Reference: | CVE-2014-5097 |
| Risk Level: | High |
 | |
| CVSSv2 Base Score: | 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P) |
| Solution Status: | Solution Available |
| Discovered and Provided: | High-Tech Bridge Security Research Lab |
| Advisory Details: | |
High-Tech Bridge Security Research Lab discovered SQL injection vulnerability in ArticleFR, which can be exploited to perform SQL Injection attacks and gain complete control over vulnerable website. | |
| Solution: | |
| Disclosure timeline: 2014-07-23 Vendor Alerted via emails. 2014-07-31 Vendor Alerted via emails. 2014-07-31 Issue created on GitHub. 2014-08-04 Vendor closed issue on GitHub. 2014-08-04 Vendor locked and limited conversation to collaborators on GitHub. 2014-08-07 Fix Requested via emails. 2014-08-11 Fix Requested via emails. 2014-08-18 Fix Requested via emails. 2014-08-20 Public disclosure with self-written patch. Currently we are not aware of any official solution for this vulnerability. Unofficial patch was developed by High-Tech Bridge Security Research Lab and is available here: https://www.immuniweb.com/advisory/HTB23225-patch.zip | |
References: | |
| [1] High-Tech Bridge Advisory HTB23225 - https://www.immuniweb.com/advisory/HTB23225 - SQL Injection Vulnerability in ArticleFR in ArticleFR. [2] ArticleFR - http://freereprintables.com/ - Free Article Directory CMS System . [3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE® is a dictionary of publicly known information security vulnerabilities and exposures. [4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types. [5] ImmuniWeb® - Leveraging the power of machine-learning and genius of human brain to deliver the most advanced web application security and penetration testing. [6] ImmuniWeb® SSLScan - Test your servers for security and compliance with PCI DSS, HIPAA and NIST. | |
Please feel free to send us any additional information related to this Advisory, such as vulnerable versions, additional exploitation details and conditions, patches and other relevant details.
