Home > Vulnerability Database > CVE-2014-9115

WhiteSource Vulnerability Database

CVE-2014-9115

Good to know:

Date: December 23, 2014

SQL injection vulnerability in the rate_picture function in include/functions_rate.inc.php in Piwigo before 2.5.5, 2.6.x before 2.6.4, and 2.7.x before 2.7.2 allows remote attackers to execute arbitrary SQL commands via the rate parameter to picture.php, related to an improper data type in a comparison of a non-numeric value that begins with a digit.

Language: PHP

Severity Score

7.5

Related Resources (5)

Url: http://piwigo.org/forum/viewtopic.php?id=24850

Url: http://seclists.org/fulldisclosure/2014/Nov/23

Url: http://piwigo.org/releases/2.7.2

Url: https://nvd.nist.gov/vuln/detail/CVE-2014-9115

Url: https://www.whitesourcesoftware.com/vulnerability-database/CVE-2014-9115

Severity Score

7.5

Weakness Type (CWE)

SQL Injection

CWE-89

Top Fix

Upgrade Version

Upgrade to version 2.5.5,2.6.4,2.7.2

Learn More

CVSS v2

Base Score:	7.5
Access Vector (AV):	NETWORK
Access Complexity (AC):	LOW
Authentication (AU):	NONE
Confidentiality (C):	PARTIAL
Integrity (I):	PARTIAL
Availability (A):	PARTIAL
Additional information:

WhiteSource Vulnerability Database

We found results for “”

CVE-2014-9115

Good to know:

Date: December 23, 2014

Language: PHP

Severity Score

Related Resources (5)

Severity Score

Weakness Type (CWE)

Top Fix

Upgrade Version

CVSS v2

Do you need more information?