CVE-2015-2972

Multiple SQL injection vulnerabilities in Sysphonic Thetis before 2.3.0 allow remote attackers to execute arbitrary SQL commands via unspecified vectors.

• CWE-89

• http://jvn.jp/en/jp/JVN19011483/index.htmlVendor Advisory
• http://jvndb.jvn.jp/jvndb/JVNDB-2015-000099Vendor Advisory
• http://sysphonic.com/en/thetis/THETIS-SEC-001.htmlVendor Advisory
• https://github.com/sysphonic/thetis/commit/1b8234706e1294f41df42f3d1ccb71b983ffbe23
• https://github.com/sysphonic/thetis/commit/4ca3f5f486759660b87d7c146f1fdc11264f56eb
• https://github.com/sysphonic/thetis/commit/8004ee0c384daae0b28478ff8193d1990c397f57
• https://github.com/sysphonic/thetis/commit/842e44f0c2bd7d680430bb89a3bb78fd744961f9
• https://github.com/sysphonic/thetis/commit/a61dc72035c7ae0b06f6d7dc8b2a848ffc7db277
• https://github.com/sysphonic/thetis/commit/c07e255d2296d50a0bffafaf66a76f8f1b53621f
• https://github.com/sysphonic/thetis/commit/ce535a38ec92ff0f98af11ab41a425d1529a31ef
• https://github.com/sysphonic/thetis/commit/d9ed965075634ca1a095b480b459c68445ce951d
• http://jvn.jp/en/jp/JVN19011483/index.htmlVendor Advisory
• http://jvndb.jvn.jp/jvndb/JVNDB-2015-000099Vendor Advisory
• http://sysphonic.com/en/thetis/THETIS-SEC-001.htmlVendor Advisory
• https://github.com/sysphonic/thetis/commit/1b8234706e1294f41df42f3d1ccb71b983ffbe23
• https://github.com/sysphonic/thetis/commit/4ca3f5f486759660b87d7c146f1fdc11264f56eb
• https://github.com/sysphonic/thetis/commit/8004ee0c384daae0b28478ff8193d1990c397f57
• https://github.com/sysphonic/thetis/commit/842e44f0c2bd7d680430bb89a3bb78fd744961f9
• https://github.com/sysphonic/thetis/commit/a61dc72035c7ae0b06f6d7dc8b2a848ffc7db277
• https://github.com/sysphonic/thetis/commit/c07e255d2296d50a0bffafaf66a76f8f1b53621f
• https://github.com/sysphonic/thetis/commit/ce535a38ec92ff0f98af11ab41a425d1529a31ef
• https://github.com/sysphonic/thetis/commit/d9ed965075634ca1a095b480b459c68445ce951d

Published

Jul 19, 2015

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-2966Directory traversal vulnerability in the Droidware UK Explor…
• CVE-2015-2967Cross-site scripting (XSS) vulnerability in settings.php in …
• CVE-2015-2968LINE@ for Android version 1.0.0 and LINE@ for iOS version 1.…5.9
• CVE-2015-2969Cross-site scripting (XSS) vulnerability in index.php in LEM…
• CVE-2015-2970index.php in LEMON-S PHP Simple Oekaki BBS before 1.21 allow…
• CVE-2015-2971Directory traversal vulnerability in Seeds acmailer before 3…
• CVE-2015-2973Multiple cross-site scripting (XSS) vulnerabilities in the W…
• CVE-2015-2974LEMON-S PHP Gazou BBS plus before 2.36 allows remote attacke…
• CVE-2015-2975Research Artisan Lite before 1.18 does not ensure that a use…
• CVE-2015-2976Multiple cross-site scripting (XSS) vulnerabilities in Resea…
• CVE-2015-2977Webservice-DIC yoyaku_v41 allows remote attackers to create …
• CVE-2015-2978Webservice-DIC yoyaku_v41 allows remote attackers to bypass …