PT-2018-18245

CVE-2018-7734

·

Published

2018-03-06

·

Updated

2018-03-26

Description by

CVSS 3.1
7.2
High
MetricsAV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions: Afian FileRun versions prior to 2018.02.13
Description: The issue allows for remote SQL injection when an attacker is logged in as a superuser. This can be achieved via the search parameter in a "/?module=users&section=cpanel&page=list" API endpoint.
Recommendations: For versions prior to 2018.02.13, update to version 2018.02.13 or later to resolve the issue.
Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')
Related identifiers
CVE-2018-7734
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com