CVE-2019-11362: SQL Injection

Published Apr 20, 2019

Updated

app/controllers/frontend/PostController.php in ROCBOSS V2.2.1 has SQL injection via the Post:doReward score paramter, as demonstrated by the /do/reward/3 URI.

Affected Software

1 affected component

ROCBOSS ROCBOSS=2.2.1

Remediation

Patch Available

https://github.com/rocboss/ROCBOSS/issues/12

Event History

Apr 20, 2019

CVE Published

via MITRE·12:33 PM

Data Sourced

via MITRE·12:33 PM

Description

Frequently Asked Questions

Who can exploit this issue?

The CVSS vector indicates it can be exploited remotely over the network without authentication or user interaction. An attacker able to send requests to the affected reward endpoint is exposed to the SQL injection risk.

What input is involved in exploitation?

The vulnerable input is the Post:doReward score parameter in app/controllers/frontend/PostController.php. The issue is demonstrated using the /do/reward/3 URI.

What should teams do to remediate it?

Apply the available patch. The provided data identifies ROCBOSS V2.2.1 as affected, but does not specify a fixed version.

CVE-2019-11362: SQL Injection

Affected Software

Remediation

Patch Available

Event History

Frequently Asked Questions

Who can exploit this issue?

What input is involved in exploitation?

What should teams do to remediate it?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What input is involved in exploitation?

What should teams do to remediate it?