CVE-2015-7568

SQL injection vulnerability in the password recovery feature in Yeager CMS 1.2.1 allows remote attackers to change the account credentials of known users via the "userEmail" parameter.

CVSS v3.0 NVD

9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

4.06% chance of exploitation in the next 30 days, 91st percentile

Published

2017-04-24

Updated

2024-08-06

Proof-of-concept exploits (1)

• http://packetstormsecurity.com/files/135716/Yeager-CMS-1.2.1-File-Upload-SQL-Injection-XS…

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/39436

Security advisories

• http://seclists.org/fulldisclosure/2016/Feb/44
• http://www.securityfocus.com/archive/1/537493/100/0/threaded

References

• CVE Record
• NVD entry