CVE-2011-4960

EUVD-2011-4867 · Published Sep 17, 2012

SQL injection vulnerability in the Folder::findOrMake method in SilverStripe 2.3.x before 2.3.12 and 2.4.x before 2.4.6 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

Technologies

Silverstripe Silverstripe

Weaknesses

CWE-89

CVSS scores

v2.07.5AV:N/AC:L/Au:N/C:P/I:P/A:P

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Initial Access

T1190Exploit Public-Facing Application

References

https://github.com/silverstripe/sapphire/commit/fef7c32
http://doc.silverstripe.org/framework/en/trunk/changelogs/2.3.12
http://doc.silverstripe.org/framework/en/trunk/changelogs/2.4.6
http://www.openwall.com/lists/oss-security/2012/04/30/1
http://www.openwall.com/lists/oss-security/2012/04/30/3

Potentially impacted assets

See if this affects your attack surface