CVE-2010-1078 - SQL injection vulnerability in archive.php in XlentProjects SphereCMS 1.1 alpha allows remote attackers to execute arbitrary SQL commands via encoded null bytes ("%00") in the view parameter, which bypasses a protection mechanism

Back Back to CVE browser

HIGH

SQL injection vulnerability in archive.php in XlentProjects SphereCMS 1.1 alpha allows remote attackers to execute arbitrary SQL commands via encoded null bytes ("%00") in the view parameter, which bypasses a protection mechanism

Published Mar 23, 2010

7.5

HIGH

CVSS 2.0

EPSS 1.03%

Description

SQL injection vulnerability in archive.php in XlentProjects SphereCMS 1.1 alpha allows remote attackers to execute arbitrary SQL commands via encoded null bytes ("%00") in the view parameter, which bypasses a protection mechanism.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

References (6)

http://www.bugreport.ir/index_68.htm
x_refsource_MISCExploit
http://www.packetstormsecurity.org/1002-exploits/spherecms-sql.txt
x_refsource_MISCExploit
http://www.securityfocus.com/archive/1/509603/100/0/threaded
mailing-listx_refsource_BUGTRAQ
http://www.securityfocus.com/bid/38309
vdb-entryx_refsource_BIDExploit
https://euvd.enisa.europa.eu/vulnerability/EUVD-2010-1110
Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/56423
vdb-entryx_refsource_XF

Link	Providers	Tags
http://www.bugreport.ir/index_68.htm		x_refsource_MISCExploit
http://www.packetstormsecurity.org/1002-exploits/spherecms-sql.txt		x_refsource_MISCExploit
http://www.securityfocus.com/archive/1/509603/100/0/threaded		mailing-listx_refsource_BUGTRAQ
http://www.securityfocus.com/bid/38309		vdb-entryx_refsource_BIDExploit
https://euvd.enisa.europa.eu/vulnerability/EUVD-2010-1110		Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/56423		vdb-entryx_refsource_XF