CVE-2014-3871

EPSS 2.6%

Vexday Risk Score

23Low

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Proof of concept

Public proof of concept exists, but not yet automated.

CVSS —EPSS 2.6%KEV nãoPoC públicaNuclei —Metasploit —Patch —

Lifecycle

28 Apr 2014Public PoC

27 May 2014Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

Multiple SQL injection vulnerabilities in register.php in Geodesic Solutions GeoCore MAX 7.3.3 (formerly GeoClassifieds and GeoAuctions) allow remote attackers to execute arbitrary SQL commands via the (1) c[password] or (2) c[username] parameter. NOTE: the b parameter to index.php vector is already covered by CVE-2006-3823.

Affected products

n/a · n/a

public PoCs found — 3

cve_referencewww.exploit-db.com/exploits/33075unverified cve_referencepacketstormsecurity.com/files/126329/GeoCore-MAX-DB-7.3.3-Blind-SQL-Injection.htmlunverified exploitdbwww.exploit-db.com/exploits/33075unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://geodesicsolutions.com/changelog/7.3/changelog.html http://osvdb.org/show/osvdb/106364 http://packetstormsecurity.com/files/126329/GeoCore-MAX-DB-7.3.3-Blind-SQL-Injection.html http://secunia.com/advisories/58308 http://www.exploit-db.com/exploits/33075 http://www.securityfocus.com/bid/67078