CVE-2014-8999: SQL Injection
Published Nov 20, 2014
·Updated
SQL injection vulnerability in htdocs/modules/system/admin.php in XOOPS before 2.5.7 Final allows remote authenticated users to execute arbitrary SQL commands via the selgroups parameter.
Affected Software
1 affected component
Xoops Xoops<=2.5.6
Event History
Nov 20, 2014
CVE Published
via MITRE·11:00 AM
Data Sourced
via MITRE·11:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2014-8999?
CVE-2014-8999 is considered a high severity vulnerability due to its potential for remote SQL command execution.
2
How does CVE-2014-8999 affect system security?
CVE-2014-8999 allows authenticated users to execute arbitrary SQL commands, which can compromise database integrity.
3
How do I fix CVE-2014-8999?
To fix CVE-2014-8999, upgrade your XOOPS installation to version 2.5.7 Final or later.
4
Who is affected by CVE-2014-8999?
CVE-2014-8999 affects all versions of XOOPS prior to 2.5.7 Final.
5
What is the root cause of CVE-2014-8999?
CVE-2014-8999 is caused by improper input validation in the selgroups parameter of the admin.php file.