CVE-2016-9048: SQL Injection

Published Sep 10, 2018

Updated

Multiple exploitable SQL Injection vulnerabilities exists in ProcessMaker Enterprise Core 3.0.1.7-community. Specially crafted web requests can cause SQL injections. An attacker can send a web request with parameters containing SQL injection attacks to trigger this vulnerability, potentially allowing exfiltration of the database, user credentials and in certain setups access the underlying operating system.

Affected Software

2 affected components

ProcessMaker ProcessMaker=3.0.1.7

Event History

Sep 10, 2018

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2016-9048?

CVE-2016-9048 is considered a high-severity vulnerability due to its potential for SQL injection attacks.

How do I fix CVE-2016-9048?

To fix CVE-2016-9048, ensure that you update ProcessMaker to the latest version that includes patches for the SQL injection vulnerabilities.

What type of vulnerabilities are associated with CVE-2016-9048?

CVE-2016-9048 is associated with multiple exploitable SQL injection vulnerabilities that can be triggered by specially crafted web requests.

Who is affected by CVE-2016-9048?

CVE-2016-9048 affects users of ProcessMaker Enterprise Core version 3.0.1.7-community and 3.0.1.7-enterprise.

What can an attacker do with CVE-2016-9048?

An attacker can exploit CVE-2016-9048 to execute unauthorized SQL commands, potentially compromising the database and application integrity.