PT-2014-7013
CVE-2014-6030
·
تاريخ النشر
2014-11-06
·
تاريخ التحديث
2014-11-06
الوصف من
CVSS 2.0
6.5
متوسطةالمقاييسAV:N/AC:L/Au:S/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions
ClassApps SelectSurvey.NET versions prior to 4.125.002
Description
The issue allows remote attackers to execute arbitrary SQL commands via the
SurveyID parameter to "/survey/ReviewReadOnlySurvey.aspx" or remote authenticated users to execute arbitrary SQL commands via the SurveyID parameter to "/survey/UploadImagePopupToDb.aspx".Recommendations
For versions prior to 4.125.002, update to version 4.125.002 or later to resolve the issue. As a temporary workaround, consider restricting access to the "/survey/ReviewReadOnlySurvey.aspx" and "/survey/UploadImagePopupToDb.aspx" API endpoints until the update is applied. Avoid using the
SurveyID parameter in these endpoints until the issue is resolved.قابلية الاستغلال
استغلال
إصلاح
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾