CVE-2017-12585: SQL Injection

Published Aug 6, 2017

Updated

SLiMS 8 Akasia through 8.3.1 has SQL injection in admin/AJAXlookuphandler.php (tableName and tableFields parameters), admin/AJAXcheckid.php, and admin/AJAXvocabolarycontrol.php. It can be exploited by remote authenticated librarian users.

Affected Software

5 affected components

Slims Akasia=8.0

Slims Akasia=8.1

Slims Akasia=8.2

Slims Akasia=8.3

Slims Akasia=8.3.1

Event History

Aug 6, 2017

CVE Published

via MITRE·03:00 AM

Data Sourced

via MITRE·03:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2017-12585?

CVE-2017-12585 is classified as a medium severity SQL injection vulnerability.

How do I fix CVE-2017-12585?

To fix CVE-2017-12585, update SLiMS Akasia to version 8.3.2 or later, which addresses this vulnerability.

Who is affected by CVE-2017-12585?

Remote authenticated librarian users of SLiMS Akasia versions 8.0 to 8.3.1 are affected by CVE-2017-12585.

What are the exploitation vectors for CVE-2017-12585?

CVE-2017-12585 can be exploited through SQL injection in specific AJAX handler scripts within SLiMS Akasia.

Is it possible to mitigate CVE-2017-12585 without updating software?

Mitigation without updating is challenging; however, limiting user permissions and implementing web application firewalls can reduce risk.