CVE-2018-5384

Navarino Infinity web interface up to version 2.2 exposes an unauthenticated script that is prone to blind sql injection

State: Published
Severity: Not scored
Published: Jul 24, 2018
Updated: Aug 5, 2024
Reserved: Jan 12, 2018

Read the record on cve.org

Description

Navarino Infinity web interface up to version 2.2 exposes an unauthenticated script that is prone to blind sql injection. If successfully exploited the user can get info from the underlying postgresql database that could lead into to total compromise of the product. The said script is available with no authentication.

Scores

The record has no CVSS score.

Weaknesses

CWE-89

Affected Products

Product	Versions
InfinityNavarino	2.2 to before 2.2Affected

References

https://packetstormsecurity.com/files/146506/Navarino-Infinity-Blind-SQL-Injection-Session-Fixation.html
https://medium.com/%40evstykas/pwning-ships-vsat-for-fun-and-profit-ba0fe9f42fb3
103544vdb-entry
VU#184077third-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.