CVE-2015-7299

SQL injection vulnerability in Runtime/Runtime/AjaxCall.ashx in K2 blackpearl, smartforms, and K2 for SharePoint 4.6.7 allows remote attackers to execute arbitrary SQL commands via the xml parameter.

CVSS v2.0

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

2.30% chance of exploitation in the next 30 days, 82th percentile

Published

2015-10-21

Updated

2024-08-06

Proof-of-concept exploits (1)

• http://packetstormsecurity.com/files/133953/K2-SmartForms-BlackPearl-SQL-Injection.html

References

• CVE Record
• NVD entry

Related

• CVE-2015-7297
• CVE-2015-7309
• CVE-2015-7293
• CVE-2015-7324
• CVE-2015-7259
• CVE-2015-7326