CVE-2015-1428
Last modified
CVE-2015-1428 is a vulnerability of currently unknown severity. Multiple SQL injection vulnerabilities in Sefrengo before 1.6.2 allow (1) remote attackers to execute arbitrary SQL commands via the sefrengo cookie in a login to backend/main.php or (2) remote authenticated users to execute arbitrary SQL commands via the value_id parameter in a save_value action to backend/main.php.. EPSS estimates a 2.79% chance of exploitation in the next 30 days.
Description
Multiple SQL injection vulnerabilities in Sefrengo before 1.6.2 allow (1) remote attackers to execute arbitrary SQL commands via the sefrengo cookie in a login to backend/main.php or (2) remote authenticated users to execute arbitrary SQL commands via the value_id parameter in a save_value action to backend/main.php.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Sefrengo | Sefrengo | <= 1.6.1 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2015-1428?
How severe is CVE-2015-1428?
How do I fix CVE-2015-1428?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2015
- CVE-2015-1422Multiple cross-site scripting (XSS) vulnerabilities in Gecko…
- CVE-2015-1423Multiple SQL injection vulnerabilities in Gecko CMS 2.2 and …
- CVE-2015-1424Cross-site request forgery (CSRF) vulnerability in Gecko CMS…
- CVE-2015-1425JAKWEB Gecko CMS has Multiple Input Validation Vulnerabiliti…9.8
- CVE-2015-1426Puppet Labs Facter 1.6.0 through 2.4.0 allows local users to…
- CVE-2015-1427The Groovy scripting engine in Elasticsearch before 1.3.8 an…9.8
- CVE-2015-1429Directory traversal vulnerability in Cybele Software Thinfin…7.5
- CVE-2015-1430Buffer overflow in xymon 4.3.17-1.
- CVE-2015-1431Cross-site scripting (XSS) vulnerability in includes/startup…
- CVE-2015-1432The message_options function in includes/ucp/ucp_pm_options.…
- CVE-2015-1433program/lib/Roundcube/rcube_washtml.php in Roundcube before …
- CVE-2015-1434Multiple SQL injection vulnerabilities in my little forum be…
Are you affected by CVE-2015-1428?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST