CVE-2015-1428 – Multiple SQL injection vulnerabilities in Sefrengo before 1.6.2 allow (1)

Multiple SQL injection vulnerabilities in Sefrengo before 1.6.2 allow (1) remote attackers to execute arbitrary SQL commands via the sefrengo cookie in a login to backend/main.php or (2) remote authenticated users to execute arbitrary SQL commands via the value_id parameter in a save_value action to backend/main.php.

 

Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1428

Reference (s):

• BUGTRAQ:20150202 Sefrengo CMS v1.6.1 – Multiple SQL Injection Vulnerabilities
• URL: http://www.securityfocus.com/archive/1/534593/100/0/threaded
• EXPLOIT-DB:35972
• URL: http://www.exploit-db.com/exploits/35972
• http://www.itas.vn/news/itas-team-found-out-multiple-sql-injection-vulnerabilities-in-sefrengo-cms-v1-6-1-74.html