CVE-2010-4915

EPSS 1.2%

Vexday Risk Score

23Low

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Proof of concept

Public proof of concept exists, but not yet automated.

CVSS —EPSS 1.2%KEV nãoPoC públicaNuclei —Metasploit —Patch —

Lifecycle

07 Sep 2010Public PoC

08 Oct 2011Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

SQL injection vulnerability in index.cfm in ColdGen ColdBookmarks 1.22 allows remote attackers to execute arbitrary SQL commands via the BookmarkID parameter in an EditBookmark action.

Affected products

n/a · n/a

public PoCs found — 3

cve_referencepacketstormsecurity.org/1009-exploits/coldbookmarks-sql.txtunverified cve_referencewww.exploit-db.com/exploits/14933unverified exploitdbwww.exploit-db.com/exploits/14933unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://packetstormsecurity.org/1009-exploits/coldbookmarks-sql.txt http://secunia.com/advisories/41334 http://securityreason.com/securityalert/8449 https://exchange.xforce.ibmcloud.com/vulnerabilities/61638 http://www.exploit-db.com/exploits/14933 http://www.securityfocus.com/bid/43035