CVE-2012-6434: SQL Injection

Published Jan 3, 2013

Updated

Multiple cross-site request forgery (CSRF) vulnerabilities in e107admin/download.php in e107 1.0.2 allow remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the (1) downloadurl, (2) downloadurlextended, (3) downloadauthoremail, (4) downloadauthorwebsite, (5) downloadimage, (6) downloadthumb, (7) downloadvisible, or (8) downloadclass parameter.

Affected Software

1 affected component

e107 e107=1.0.2

Remediation

Patch Available

http://e107.svn.sourceforge.net/viewvc/e107/trunk/e107_0.7/e107_admin/download.php?sortdir=down&r1=13037&r2=13058&sortby=rev

Event History

Jan 3, 2013

CVE Published

via MITRE·11:00 AM

Data Sourced

via MITRE·11:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2012-6434?

CVE-2012-6434 is considered a high severity vulnerability due to its potential for cross-site request forgery (CSRF) attacks that can lead to SQL injection.

How do I fix CVE-2012-6434?

To fix CVE-2012-6434, upgrade e107 CMS to the latest version that addresses the CSRF vulnerabilities.

What types of attacks can be executed using CVE-2012-6434?

CVE-2012-6434 can be exploited to perform malicious actions by hijacking authenticated administrator sessions to conduct SQL injection attacks.

Which versions of e107 are affected by CVE-2012-6434?

CVE-2012-6434 specifically affects e107 version 1.0.2.

Are there any workarounds for CVE-2012-6434?

Temporary workarounds for CVE-2012-6434 include restricting access to the affected download.php file for untrusted users.