CVE-2014-2317: SQL Injection
Published Mar 7, 2014
·Updated
SQL injection vulnerability in ajaxudf.php in OpenDocMan before 1.2.7.2 allows remote attackers to execute arbitrary SQL commands via the table parameter. NOTE: some of these details are obtained from third party information.
Affected Software
12 affected components
OpenDocMan OpenDocMan<=1.2.7.1
OpenDocMan OpenDocMan=1.2.6.2
OpenDocMan OpenDocMan=1.2.6.2-a
OpenDocMan OpenDocMan=1.2.6.2-b
OpenDocMan OpenDocMan=1.2.6.3
OpenDocMan OpenDocMan=1.2.6.3-a
OpenDocMan OpenDocMan=1.2.6.5
OpenDocMan OpenDocMan=1.2.6.6
OpenDocMan OpenDocMan=1.2.6.7
OpenDocMan OpenDocMan=1.2.6.7-beta
OpenDocMan OpenDocMan=1.2.6.8
OpenDocMan OpenDocMan=1.2.7
Remediation
Patch Available
Event History
Mar 7, 2014
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
Description
Mar 9, 2014
Data Sourced
via NVD·01:16 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2014-2317?
CVE-2014-2317 has a severity rating that reflects the risk of SQL injection attacks leading to data compromise.
2
How do I fix CVE-2014-2317?
To fix CVE-2014-2317, upgrade to OpenDocMan version 1.2.7.2 or later.
3
What are the implications of CVE-2014-2317?
Exploitation of CVE-2014-2317 allows attackers to execute arbitrary SQL commands in the database.
4
Which versions of OpenDocMan are affected by CVE-2014-2317?
OpenDocMan versions prior to 1.2.7.2, including versions 1.2.7.1 and earlier, are affected by CVE-2014-2317.
5
How can I detect if my system is vulnerable to CVE-2014-2317?
You can detect vulnerability to CVE-2014-2317 by testing for unsanitized input in the ajax_udf.php file for SQL injection flaws.