CVE-2020-29280 - OpenCVE

The Victor CMS v1.0 application is vulnerable to SQL injection via the 'search' parameter on the search.php page.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

AV:N/AC:L/Au:N/C:P/I:P/A:P

Vendors & Products
CPE Configurations

Vendors	Products
Victor Cms Project	Victor Cms

Configuration 1 [-]

cpe:2.3:a:victor_cms_project:victor_cms:1.0:*:*:*:*:*:*:*

References

Link	Resource
https://github.com/BigTiger2020/Victor-CMS-/blob/main/README.md	Third Party Advisory
https://github.com/VictorAlagwu/CMSsite/issues/13	Third Party Advisory
https://www.exploit-db.com/exploits/48734	Third Party Advisory VDB Entry

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: mitre

Published: 2020-12-02T21:08:39

Updated: 2020-12-02T21:08:39

Reserved: 2020-11-27T00:00:00

Link: CVE-2020-29280

JSON object: View

NVD Information

Status : Analyzed

Published: 2020-12-02T22:15:10.417

Modified: 2020-12-03T01:39:14.513

Link: CVE-2020-29280

JSON object: View

Redhat Information

No data.

CWE

CWE-89

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:victor_cms_project:victor_cms:1.0:*:*:*:*:*:*:*", "matchCriteriaId": "2E246CC4-AA7A-4C17-B950-8B0D1D690F19", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The Victor CMS v1.0 application is vulnerable to SQL injection via the 'search' parameter on the search.php page."}, {"lang": "es", "value": "La aplicaci\u00f3n Victor CMS versi\u00f3n v1.0, es vulnerable a una inyecci\u00f3n SQL por medio del par\u00e1metro \"search\" en la p\u00e1gina search.php"}], "id": "CVE-2020-29280", "lastModified": "2020-12-03T01:39:14.513", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-12-02T22:15:10.417", "references": [{"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://github.com/BigTiger2020/Victor-CMS-/blob/main/README.md"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://github.com/VictorAlagwu/CMSsite/issues/13"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://www.exploit-db.com/exploits/48734"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "nvd@nist.gov", "type": "Primary"}]}