CVE-2014-2245: SQL Injection
Published Mar 5, 2014
·Updated
SQL injection vulnerability in the News module in CMS Made Simple (CMSMS) before 1.11.10 allows remote authenticated users with the "Modify News" permission to execute arbitrary SQL commands via the sortby parameter to admin/moduleinterface.php. NOTE: some of these details are obtained from third party information.
Affected Software
64 affected components
CMSmadesimple CMS Made Simple<=1.11.9
CMSmadesimple CMS Made Simple=0.1
CMSmadesimple CMS Made Simple=0.2
CMSmadesimple CMS Made Simple=0.2.1
CMSmadesimple CMS Made Simple=0.3
CMSmadesimple CMS Made Simple=0.3.1
CMSmadesimple CMS Made Simple=0.3.2
CMSmadesimple CMS Made Simple=0.4
CMSmadesimple CMS Made Simple=0.4.1
CMSmadesimple CMS Made Simple=0.5
CMSmadesimple CMS Made Simple=0.5.1
CMSmadesimple CMS Made Simple=0.6
CMSmadesimple CMS Made Simple=0.6.1
CMSmadesimple CMS Made Simple=0.6.2
CMSmadesimple CMS Made Simple=0.6.3
CMSmadesimple CMS Made Simple=0.7
CMSmadesimple CMS Made Simple=0.7.1
CMSmadesimple CMS Made Simple=0.7.2
CMSmadesimple CMS Made Simple=0.7.3
CMSmadesimple CMS Made Simple=0.8
CMSmadesimple CMS Made Simple=0.8.1
CMSmadesimple CMS Made Simple=0.8.2
CMSmadesimple CMS Made Simple=0.9
CMSmadesimple CMS Made Simple=0.9.1
CMSmadesimple CMS Made Simple=0.9.2
CMSmadesimple CMS Made Simple=0.10
CMSmadesimple CMS Made Simple=0.10.1
CMSmadesimple CMS Made Simple=0.10.2
CMSmadesimple CMS Made Simple=0.10.3
CMSmadesimple CMS Made Simple=0.10.4
CMSmadesimple CMS Made Simple=0.11
CMSmadesimple CMS Made Simple=0.11.1
CMSmadesimple CMS Made Simple=0.11.2
CMSmadesimple CMS Made Simple=0.12
CMSmadesimple CMS Made Simple=0.12.1
CMSmadesimple CMS Made Simple=0.12.2
CMSmadesimple CMS Made Simple=0.13
CMSmadesimple CMS Made Simple=1.0
CMSmadesimple CMS Made Simple=1.0.1
CMSmadesimple CMS Made Simple=1.0.2
CMSmadesimple CMS Made Simple=1.0.3
CMSmadesimple CMS Made Simple=1.0.4
CMSmadesimple CMS Made Simple=1.0.5
CMSmadesimple CMS Made Simple=1.0.6
CMSmadesimple CMS Made Simple=1.1
CMSmadesimple CMS Made Simple=1.1.1
CMSmadesimple CMS Made Simple=1.1.2
CMSmadesimple CMS Made Simple=1.1.3
CMSmadesimple CMS Made Simple=1.1.3.1
CMSmadesimple CMS Made Simple=1.1.4
CMSmadesimple CMS Made Simple=1.10
CMSmadesimple CMS Made Simple=1.10.1
CMSmadesimple CMS Made Simple=1.10.2
CMSmadesimple CMS Made Simple=1.10.3
CMSmadesimple CMS Made Simple=1.11
CMSmadesimple CMS Made Simple=1.11.1
CMSmadesimple CMS Made Simple=1.11.2
CMSmadesimple CMS Made Simple=1.11.2.1
CMSmadesimple CMS Made Simple=1.11.3
CMSmadesimple CMS Made Simple=1.11.4
CMSmadesimple CMS Made Simple=1.11.5
CMSmadesimple CMS Made Simple=1.11.6
CMSmadesimple CMS Made Simple=1.11.7
CMSmadesimple CMS Made Simple=1.11.8
Event History
Mar 5, 2014
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
Data Sourced
via NVD·04:37 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2014-2245?
CVE-2014-2245 has been classified as a high severity SQL injection vulnerability.
2
How do I fix CVE-2014-2245?
To fix CVE-2014-2245, upgrade to CMS Made Simple version 1.11.10 or later.
3
Who is affected by CVE-2014-2245?
Only authenticated users with the 'Modify News' permission in CMS Made Simple versions prior to 1.11.10 are affected.
4
What type of vulnerability is CVE-2014-2245?
CVE-2014-2245 is an SQL injection vulnerability allowing attackers to execute arbitrary SQL commands.
5
When was CVE-2014-2245 published?
CVE-2014-2245 was published in March 2014.