CVE-2014-5387 in ExpressionEngine

Resumen (Inglés)

Multiple SQL injection vulnerabilities in EllisLab ExpressionEngine before 2.9.1 allow remote authenticated users to execute arbitrary SQL commands via the (1) column_filter or (2) category[] parameter to system/index.php or the (3) tbl_sort[0][] parameter in the comment module to system/index.php.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Reservar

2014-08-22

Divulgación

2014-11-04

Estado

Confirmado

Voces

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerabilidad	CWE	Exp	Con	CVE
72791	EllisLab ExpressionEngine inyección SQL	89	No está definido	Arreglo oficial	CVE-2014-5387

Fuentes

• MITRE
• NVD
• CVE Details