CVE-2017-6492: SQL Injection
Published Mar 5, 2017
·Updated
SQL Injection was discovered in admprogram/modules/dates/datesfunction.php in Admidio 3.2.5. The POST parameter datcatid is concatenated into a SQL query without any input validation/sanitization.
Affected Software
1 affected component
Admidio Admidio=3.2.5
Event History
Mar 5, 2017
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
Description
Data Sourced
via NVD·08:59 PM
DescriptionSeverityWeaknessAffected Software
Dec 13, 58332
Event
10:05 PM
Frequently Asked Questions
1
What is the severity of CVE-2017-6492?
CVE-2017-6492 is considered a critical severity SQL Injection vulnerability.
2
How do I fix CVE-2017-6492?
To fix CVE-2017-6492, ensure that input from the dat_cat_id POST parameter is properly validated and sanitized before being included in SQL queries.
3
What systems are affected by CVE-2017-6492?
CVE-2017-6492 affects Admidio version 3.2.5.
4
Can CVE-2017-6492 lead to data breaches?
Yes, CVE-2017-6492 can potentially allow attackers to execute arbitrary SQL commands, leading to data breaches.
5
Is there a patch available for CVE-2017-6492?
There are no official patches available specifically for CVE-2017-6492, so manual remediation is required.