CVE-2010-0614

23Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 1.2%

from disclosure to weapon0 days

Published on NVDFeb 11

1st PoCFeb 5

exploitation probability

1.2%top 35% of all CVEs

observed exploitation

nono source reports it

2 public exploit(s)

SQL injection vulnerability in ajax.php in evalSMSI 2.1.03 allows remote attackers to execute arbitrary SQL commands via the query parameter in the (1) question action, and possibly the (2) sub_par or (3) num_quest actions.

Affected products

n/a · n/a

public PoCs found — 2✓ VexDay Proof

exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/33602 cve_referencepacketstormsecurity.org/1002-exploits/corelan-10-008-evalmsi.txtunverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://packetstormsecurity.org/1002-exploits/corelan-10-008-evalmsi.txt http://secunia.com/advisories/38478 https://exchange.xforce.ibmcloud.com/vulnerabilities/56152 http://www.corelan.be:8800/index.php/forum/security-advisories/corelan-10-008-evalmsi-2-1-03-multiple-vulnerabilities/http://www.osvdb.org/62177 http://www.securityfocus.com/archive/1/509370/100/0/threaded http://www.securityfocus.com/bid/38116