- Description
- Multiple SQL injection vulnerabilities in Sticky Notes before 0.2.27052012.5 allow remote attackers to execute arbitrary SQL commands via the (1) paste id in admin/modules/mod_pastes.php or (2) show.php, (3) user id to admin/modules/mod_users.php, (4) project to list.php, or (5) session id to show.php.
- Source
- cve@mitre.org
- NVD status
- Deferred
CVSS 2.0
- Type
- Primary
- Base score
- 7.5
- Impact score
- 6.4
- Exploitability score
- 10
- Vector string
- AV:N/AC:L/Au:N/C:P/I:P/A:P
- nvd@nist.gov
- CWE-89
- Hype score
- Not currently trending
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sayakbanerjee:sticky_notes:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EF1DE029-1B82-41F1-BC48-3E622B971417",
"versionEndIncluding": "0.2.27052012.5"
},
{
"criteria": "cpe:2.3:a:sayakbanerjee:sticky_notes:0.2.27052012.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FAF542C0-6E13-48A7-BB87-31EDCD728B3B"
}
],
"operator": "OR"
}
]
}
]