CVE-2015-2679

23Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 5.6%

from disclosure to weapon0 days

Published on NVDMar 23

1st PoCMar 10

exploitation probability

5.6%top 8% of all CVEs

observed exploitation

nono source reports it

3 public exploit(s)

Multiple SQL injection vulnerabilities in MetalGenix GeniXCMS before 0.0.2 allow remote attackers to execute arbitrary SQL commands via the (1) page parameter to index.php or (2) username parameter to gxadmin/login.php.

Affected products

n/a · n/a

public PoCs found — 3

exploitdbwww.exploit-db.com/exploits/36321unverified cve_referencepacketstormsecurity.com/files/130770/GeniXCMS-0.0.1-SQL-Injection.htmlunverified cve_referencewww.exploit-db.com/exploits/36321unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://blog.metalgenix.com/genixcms-v0-0-2-release-security-and-bug-fixes/17 http://blog.metalgenix.com/update-security-fix-and-add-newsletter-module/16 http://osvdb.org/show/osvdb/119392 http://osvdb.org/show/osvdb/119393 http://packetstormsecurity.com/files/130770/GeniXCMS-0.0.1-SQL-Injection.html https://github.com/semplon/GeniXCMS/commit/698245488343396185b1b49e7482ee5b25541815 https://github.com/semplon/GeniXCMS/issues/7 http://www.exploit-db.com/exploits/36321 http://www.securityfocus.com/bid/73297 http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5232.php