CVE-2013-3727

SQL injection vulnerability in Kasseler CMS before 2 r1232 allows remote authenticated users to execute arbitrary SQL commands via the groups[] parameter to admin.php. NOTE: this can be leveraged using CSRF to allow remote unauthenticated attackers to execute arbitrary SQL commands.

CVSS v2.0 NVD

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

2.91% chance of exploitation in the next 30 days, 87th percentile

Published

2014-03-13

Updated

2024-08-06

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/26623

Security advisories

• http://diff.kasseler-cms.net/svn/patches/1232.html

References

• CVE Record
• NVD entry