CVE-2015-2679

Multiple SQL injection vulnerabilities in MetalGenix GeniXCMS before 0.0.2 allow remote attackers to execute arbitrary SQL commands via the (1) page parameter to index.php or (2) username parameter to gxadmin/login.php.

CVSS v2.0 NVD

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

5.58% chance of exploitation in the next 30 days, 93rd percentile

Published

2015-03-23

Updated

2024-08-06

Proof-of-concept exploits (1)

• http://www.exploit-db.com/exploits/36321

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/36321

Security advisories

• http://blog.metalgenix.com/update-security-fix-and-add-newsletter-module/16
• http://blog.metalgenix.com/genixcms-v0-0-2-release-security-and-bug-fixes/17
• http://www.securityfocus.com/bid/73297

References

• CVE Record
• NVD entry