CVE-2018-25071

roxlukas LMeve proxy.php insert_log sql injection

State: Published
Severity: 5.5 Medium
Published: Jan 7, 2023
Updated: Aug 5, 2024
Reserved: Jan 7, 2023

Description

A vulnerability was found in roxlukas LMeve up to 0.1.58. It has been rated as critical. Affected by this issue is the function insert_log of the file wwwroot/ccpwgl/proxy.php. The manipulation of the argument fetch leads to sql injection. Upgrading to version 0.1.59-beta is able to address this issue. The patch is identified as c25ff7fe83a2cda1fcb365b182365adc3ffae332. It is recommended to upgrade the affected component. VDB-217610 is the identifier assigned to this vulnerability.

Scores

CVSS	Score	Vector	Source
3.1	5.5 Medium	CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L	VulDB
3.0	5.5 Medium	CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L	VulDB
2.0	5.2 Medium	AV:A/AC:L/Au:S/C:P/I:P/A:P	VulDB

Weaknesses

CWE-89 SQL Injection

Affected Products

Product	Versions
LMeveroxlukas	0.1.0Affected 0.1.1Affected 0.1.2Affected 0.1.3Affected 0.1.4Affected 0.1.5Affected 0.1.6Affected 0.1.7Affected 0.1.8Affected 0.1.9Affected 0.1.10Affected 0.1.11Affected 0.1.12Affected 0.1.13Affected 0.1.14Affected 0.1.15Affected 0.1.16Affected 0.1.17Affected 0.1.18Affected 0.1.19Affected 0.1.20Affected 0.1.21Affected 0.1.22Affected 0.1.23Affected 0.1.24Affected and 34 more versions

References

https://vuldb.com/?id.217610vdb-entrytechnical-description
https://vuldb.com/?ctiid.217610signaturepermissions-required
https://github.com/roxlukas/lmeve/commit/c25ff7fe83a2cda1fcb365b182365adc3ffae332patch
https://github.com/roxlukas/lmeve/releases/tag/0.1.59-betapatch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.