- Description
- Multiple SQL injection vulnerabilities in Scout Portal Toolkit (SPT) 1.3.1 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the ParentId parameter in SPT--BrowseResources.php, (2) ResourceId parameter in SPT--FullRecord.php, (3) ResourceOffset parameter in SPT--Home.php, and (4) F_UserName and (5) F_Password in SPT--UserLogin.php. NOTE: it was later reported that vector 1 is also present in 1.4.0.
- Source
- cve@mitre.org
- NVD status
- Deferred
CVSS 2.0
- Type
- Primary
- Base score
- 7.5
- Impact score
- 6.4
- Exploitability score
- 10
- Vector string
- AV:N/AC:L/Au:N/C:P/I:P/A:P
- nvd@nist.gov
- CWE-89
- Hype score
- Not currently trending
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:internet_scout:scout_portal_toolkit:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A27FFA72-AEB2-4912-8AB1-A60561EA5450",
"versionEndIncluding": "1.3.1"
},
{
"criteria": "cpe:2.3:a:internet_scout:scout_portal_toolkit:1.3.0_beta:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8832CFB6-D118-4958-806F-D3C023D8B6F7"
},
{
"criteria": "cpe:2.3:a:internet_scout_project:scout_portal_toolkit:1.4.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "60A81E80-EC68-4761-B6D8-E82B4D5A4DB0"
}
],
"operator": "OR"
}
]
}
]