CVE-2013-2945

SQL injection vulnerability in blogs/admin.php in b2evolution before 4.1.7 allows remote authenticated administrators to execute arbitrary SQL commands via the show_statuses[] parameter. NOTE: this can be leveraged using CSRF to allow remote unauthenticated attackers to execute arbitrary SQL commands.

CVSS v2.0 NVD

6.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P

EPSS

2.83% chance of exploitation in the next 30 days, 86th percentile

Published

2014-04-02

Updated

2024-08-06

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/25298

Security advisories

• http://b2evolution.net/news/2013/04/29/b2evolution-4-1-7-and-5-0-3
• http://www.securityfocus.com/bid/59599

References

• CVE Record
• NVD entry