Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
SQL Injection in Symphony - Vulnerability Database

SQL Injection in Symphony

Description

An SQL injection vulnerability in Symphony CMS before 2.3.2 allows remote authenticated users to execute arbitrary SQL commands via the sort parameter to system/authors/. This vulnerability can also be leveraged using CSRF to allow remote unauthenticated attackers to execute arbitrary SQL commands.

Remediation

Upgrade to the latest version of Symphony.

References

Symphony 2.3.2 Fixes

Related Vulnerabilities

CRMEB SQL Injection (CVE-2024-36837) High
Common tags: Known Vulnerabilities SQL Injection
OpenX xajaxargs SQL injection vulnerability High
Common tags: Known Vulnerabilities SQL Injection
Joomla! 1.7/2.5 SQL injection vulnerability High
Common tags: Known Vulnerabilities SQL Injection
Parallels Plesk SQL injection vulnerability High
Common tags: Known Vulnerabilities SQL Injection
Joomla! 1.6.0 SQL injection vulnerability High
Common tags: Known Vulnerabilities SQL Injection

Severity

High

Classification

CVE-2013-2559
CWE-89
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Tags

Known Vulnerabilities
SQL Injection