VDB
CVE-2013-2945
CVE-2013-2945
PUBLISHED
CVSS 6.5 MEDIUM
SQL injection vulnerability in blogs/admin.php in b2evolution before 4.1.7 allows remote authenticated administrators to execute arbitrary SQL commands via the show_statuses[] parameter. NOTE: this can be leveraged using CSRF to allow remote unauthenticated attackers to execute arbitrary SQL commands.
EPSS 2.82% · 86.5th percentile
Risk Scores
CVSS 2.0
6.5
EPSS Score
2.82%
86.5th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| b2evolution | b2evolution | 4.1.3, 0, 4.1.0 |
| n/a | n/a | n/a |
Timeline
- May 2, 2013 PoC Published
- Apr 2, 2014 CVE Published
- Feb 4, 2022 EPSS Score
- Mar 29, 2022 EPSS Score
- May 21, 2022 EPSS Score
- Sep 5, 2022 EPSS Score
- Oct 28, 2022 EPSS Score
- Dec 20, 2022 EPSS Score
- Feb 11, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- May 28, 2023 EPSS Score
- Jul 20, 2023 EPSS Score
References
- b2evolution-admin-sql-injection(83950) vdb
- 59599 vdb
- http://packetstormsecurity.com/files/121481/b2evolution-4.1.6-SQL-Injection.html url
- http://b2evolution.net/news/2013/04/29/b2evolution-4-1-7-and-5-0-3 url
- https://www.htbridge.com/advisory/HTB23152 url
- 20130501 SQL Injection in b2evolution mailing-list
- 92905 vdb
- https://nvd.nist.gov/vuln/detail/CVE-2013-2945 advisory