CVE-2017-7290

SQL injection vulnerability in XOOPS 2.5.7.2 and other versions before 2.5.8.1 allows remote authenticated administrators to execute arbitrary SQL commands via the url parameter to findusers.php. An example attack uses "into outfile" to create a backdoor program.

CVSS v3.0

7.2 HIGHCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

6.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P

EPSS

2.30% chance of exploitation in the next 30 days, 82th percentile

Published

2017-03-30

Updated

2024-08-05

Proof-of-concept exploits (1)

• https://gist.github.com/jk1986/3b304ac6b4ae52ae667bba380c2dce19

References

• CVE Record
• NVD entry

Related

• CVE-2017-7285
• CVE-2017-7293
• CVE-2017-7284
• CVE-2017-7308
• CVE-2017-7281
• CVE-2017-7310