CVE-2011-5110

Multiple SQL injection vulnerabilities in Blogs Manager 1.101 and earlier allow remote attackers to execute arbitrary SQL commands via the SearchField parameter in a search action to (1) _authors_list.php, (2) _blogs_list.php, (3) _category_list.php, (4) _comments_list.php, (5) _policy_list.php, (6) _rate_list.php, (7) categoriesblogs_list.php, (8) chosen_authors_list.php, (9) chosen_blogs_list.php, (10) chosen_comments_list.php, and (11) help_list.php in blogs/.

CVSS v2.0

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

2.42% chance of exploitation in the next 30 days, 83th percentile

Published

2012-08-23

Updated

2024-08-07

Proof-of-concept exploits (1)

• http://www.exploit-db.com/exploits/18129

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/18129

References

• CVE Record
• NVD entry

Related

• CVE-2011-5109
• CVE-2011-5111
• CVE-2011-5108
• CVE-2011-5112
• CVE-2011-5107
• CVE-2011-5113