CVE-2014-9445 in GQ File Manager
Summary
by MITRE
SQL injection vulnerability in incl/create.inc.php in Installatron GQ File Manager 0.2.5 allows remote attackers to execute arbitrary SQL commands via the create parameter to index.php. NOTE: this can be leveraged for cross-site scripting (XSS) attacks by creating a file that generates an error. NOTE: this issue was originally incorrectly mapped to CVE-2014-1137; see CVE-2014-1137 for more information.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 02/03/2025
The vulnerability identified as CVE-2014-9445 represents a critical SQL injection flaw within the Installatron GQ File Manager version 0.2.5, specifically affecting the incl/create.inc.php component. This vulnerability exists in the web application's handling of user input through the create parameter in index.php, creating a pathway for remote attackers to execute arbitrary SQL commands against the underlying database. The flaw demonstrates a classic improper input validation issue that allows malicious actors to manipulate database queries by injecting malicious SQL code through the application's interface.
The technical implementation of this vulnerability stems from inadequate sanitization of user-supplied data within the file manager's creation functionality. When an attacker submits malicious input through the create parameter, the application fails to properly escape or validate the input before incorporating it into SQL queries. This lack of input validation creates a direct injection point where attacker-controlled data can alter the intended execution flow of database operations. The vulnerability operates at the application layer and requires no special privileges to exploit, making it particularly dangerous as it can be leveraged from any remote location with network access to the vulnerable system.
The operational impact of this vulnerability extends beyond simple database compromise, as it can be weaponized to facilitate cross-site scripting attacks through the creation of malicious files that generate error conditions. This dual nature of the vulnerability means that exploitation can lead to both data breach scenarios and client-side attack vectors, significantly expanding the potential attack surface. The ability to create error-generating files through the file manager interface provides attackers with a sophisticated method for achieving persistent access or delivering malicious payloads to unsuspecting users who interact with the compromised system.
Security professionals should recognize this vulnerability as a variant of CWE-89, which specifically addresses SQL injection flaws in software applications. The vulnerability also aligns with ATT&CK technique T1071.004, which covers application layer protocol manipulation, and T1213.002, covering data from information repositories. Organizations utilizing Installatron GQ File Manager should implement immediate mitigation strategies including input validation, parameterized queries, and proper output encoding. The vulnerability's classification as a remote code execution risk necessitates urgent patching or remediation efforts, as the attack surface remains accessible to any external party with knowledge of the target system's configuration. Given the historical context of this vulnerability being incorrectly mapped to CVE-2014-1137, security teams should verify that the specific remediation for CVE-2014-9445 has been properly implemented rather than relying on incorrect vulnerability mappings that could lead to incomplete security measures.