CVE-2015-7568

SQL injection vulnerability in the password recovery feature in Yeager CMS 1.2.1 allows remote attackers to change the account credentials of known users via the "userEmail" parameter.

Score

CVSS 3.0 9.8 Critical

Status

Modified - secalert@redhat.com

Published

2017-04-24

Last modified

2024-08-06

Weaknesses

CWE-89

Affected products

• Yeager Cms (Yeager)

References

• http://packetstormsecurity.com/files/135716/Yeager-CMS-1.2.1-File-Upload-SQL-Injection-XSS-SSRF.html
• http://seclists.org/fulldisclosure/2016/Feb/44
• http://www.securityfocus.com/archive/1/537493/100/0/threaded
• https://www.exploit-db.com/exploits/39436/