CVE-2015-10053 — prodigasistemas curupira passwords_controller.rb sql injection

Back Back to CVE browser

CRITICAL

prodigasistemas curupira passwords_controller.rb sql injection

Published Jan 16, 2023

9.8

CRITICAL

CVSS 3.1

EPSS 0.74%

Description

A vulnerability classified as critical has been found in prodigasistemas curupira up to 0.1.3. Affected is an unknown function of the file app/controllers/curupira/passwords_controller.rb. The manipulation leads to sql injection. Upgrading to version 0.1.4 is able to address this issue. The patch is identified as 93a9a77896bb66c949acb8e64bceafc74bc8c271. It is recommended to upgrade the affected component. VDB-218394 is the identifier assigned to this vulnerability.

Affected products

Vendor Prodigasistemas Product Curupira Default
n/a
- Version
  0.1.0
  Status
  affected
  Constraints
  -
- Version
  0.1.1
  Status
  affected
  Constraints
  -
- Version
  0.1.2
  Status
  affected
  Constraints
  -
- Version
  0.1.3
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Prodigasistemas

Curupira

n/a

Version	Status	Constraints
0.1.0	affected	-
0.1.1	affected	-
0.1.2	affected	-
0.1.3	affected	-

Remediation

No remediation recorded yet.

Metrics

0.74% 0.00744

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.00744

Score over time

2023–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (12 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	0.74% (0.00744)	53.07th	v5 (v2026.06.15)
Jun 15, 2026	0.74% (0.00744)	49.74th	v5 (v2026.06.15)
Mar 17, 2025	0.04% (0.00036)	7.17th	v4 (v2025.03.14)
Dec 12, 2024	0.15% (0.00150)	52.59th	v3 (v2023.03.01)
Jun 28, 2024	0.15% (0.00154)	51.95th	v3 (v2023.03.01)
Feb 18, 2024	0.14% (0.00141)	48.58th	v3 (v2023.03.01)
Jan 23, 2024	0.12% (0.00118)	45.76th	v3 (v2023.03.01)
Dec 17, 2023	0.07% (0.00068)	28.10th	v3 (v2023.03.01)
Mar 7, 2023	0.06% (0.00058)	22.58th	v3 (v2023.03.01)
Mar 6, 2023	1.02% (0.01018)	40.69th	v2 (v2022.01.01)
Jan 25, 2023	1.02% (0.01018)	40.02th	v2 (v2022.01.01)
Jan 17, 2023	0.95% (0.00950)	31.67th	v2 (v2022.01.01)

Weaknesses (1)

CWE-89

SQL Injection

References (7)

https://github.com/advisories/GHSA-85gf-wr67-f83w
Advisory
https://github.com/prodigasistemas/curupira/commit/93a9a77896bb66c949acb8e64bceafc74bc8c271
patchThird Party Advisory
https://github.com/prodigasistemas/curupira/releases/tag/v0.1.4
patchRelease NotesThird Party Advisory
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/curupira/CVE-2015-10053.yml
https://nvd.nist.gov/vuln/detail/CVE-2015-10053
https://vuldb.com/?ctiid.218394
signaturepermissions-requiredThird Party Advisory
https://vuldb.com/?id.218394
vdb-entrytechnical-descriptionThird Party Advisory

Link	Providers	Tags
https://github.com/advisories/GHSA-85gf-wr67-f83w		Advisory
https://github.com/prodigasistemas/curupira/commit/93a9a77896bb66c949acb8e64bceafc74bc8c271		patchThird Party Advisory
https://github.com/prodigasistemas/curupira/releases/tag/v0.1.4		patchRelease NotesThird Party Advisory
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/curupira/CVE-2015-10053.yml
https://nvd.nist.gov/vuln/detail/CVE-2015-10053
https://vuldb.com/?ctiid.218394		signaturepermissions-requiredThird Party Advisory
https://vuldb.com/?id.218394		vdb-entrytechnical-descriptionThird Party Advisory