CVE-2015-2564: SQL Injection
SQL injection vulnerability in client-edit.php in ProjectSend (formerly cFTP) r561 allows remote authenticated users to execute arbitrary SQL commands via the id parameter to users-edit.php.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-2564?
CVE-2015-2564 is classified as a medium severity vulnerability due to the potential for remote authenticated users to execute arbitrary SQL commands.
How do I fix CVE-2015-2564?
To mitigate CVE-2015-2564, you should update ProjectSend to the latest version that has patched the SQL injection vulnerability.
Who is affected by CVE-2015-2564?
CVE-2015-2564 affects remote authenticated users of ProjectSend version r561 who can exploit the id parameter in users-edit.php.
What is the impact of CVE-2015-2564?
The impact of CVE-2015-2564 allows attackers to execute arbitrary SQL commands, which could lead to unauthorized data access or manipulation.
Is CVE-2015-2564 easy to exploit?
Yes, CVE-2015-2564 can be easily exploited by authenticated users familiar with the SQL injection technique.