CVE-2014-125049
typcn Blogile server.js getNav sql injection
- State
- Published
- Severity
- 5.5 Medium
- Published
- Jan 6, 2023
- Updated
- Aug 6, 2024
- Reserved
- Jan 6, 2023
Description
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in typcn Blogile. Affected is the function getNav of the file server.js. The manipulation of the argument query leads to sql injection. The name of the patch is cfec31043b562ffefe29fe01af6d3c5ed1bf8f7d. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217560. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.5 Medium | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L | VulDB |
| 3.0 | 5.5 Medium | CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L | VulDB |
| 2.0 | 5.2 Medium | AV:A/AC:L/Au:S/C:P/I:P/A:P | VulDB |
Weaknesses
- CWE-89 SQL Injection
Affected Products
| Product | Versions |
|---|---|
Blogiletypcn |
|
References
- https://vuldb.com/?id.217560vdb-entrytechnical-description
- https://vuldb.com/?ctiid.217560signaturepermissions-required
- https://github.com/typcn/Blogile/commit/cfec31043b562ffefe29fe01af6d3c5ed1bf8f7dpatch
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.