CVE-2014-1945: SQL Injection
Published Mar 7, 2014
·Updated
SQL injection vulnerability in ajaxudf.php in OpenDocMan before 1.2.7.2 allows remote attackers to execute arbitrary SQL commands via the addvalue parameter.
Affected Software
12 affected components
OpenDocMan OpenDocMan<=1.2.7.1
OpenDocMan OpenDocMan=1.2.6.2
OpenDocMan OpenDocMan=1.2.6.2-a
OpenDocMan OpenDocMan=1.2.6.2-b
OpenDocMan OpenDocMan=1.2.6.3
OpenDocMan OpenDocMan=1.2.6.3-a
OpenDocMan OpenDocMan=1.2.6.5
OpenDocMan OpenDocMan=1.2.6.6
OpenDocMan OpenDocMan=1.2.6.7
OpenDocMan OpenDocMan=1.2.6.7-beta
OpenDocMan OpenDocMan=1.2.6.8
OpenDocMan OpenDocMan=1.2.7
Remediation
Patch Available
Patch Available
Event History
Mar 7, 2014
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
Description
Mar 9, 2014
Data Sourced
via NVD·01:16 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2014-1945?
CVE-2014-1945 has a medium severity level due to its potential for remote SQL injection attacks.
2
How do I fix CVE-2014-1945?
To fix CVE-2014-1945, you should upgrade OpenDocMan to version 1.2.7.2 or later.
3
What are the affected versions of OpenDocMan for CVE-2014-1945?
CVE-2014-1945 affects OpenDocMan versions prior to 1.2.7.2.
4
What type of attack can be performed using CVE-2014-1945?
CVE-2014-1945 allows remote attackers to execute arbitrary SQL commands through the add_value parameter.
5
Is CVE-2014-1945 easy to exploit?
Yes, CVE-2014-1945 is relatively easy to exploit due to its SQL injection nature, if the application validation is lacking.