« Volver al listado

CVE-2014-1401

Estado: ModificadaMedia (6.5)—

Multiple SQL injection vulnerabilities in AuraCMS 2.3 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) search parameter to mod/content/content.php or (2) CLIENT_IP, (3) X_FORWARDED_FOR, (4) X_FORWARDED, (5) FORWARDED_FOR, or (6) FORWARDED HTTP header to index.php.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Auracms — Auracms

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2014-1401",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2014-02-11T17:55:06.857",
  "references": [
    {
      "url": "http://packetstormsecurity.com/files/125079",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/56804",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.exploit-db.com/exploits/31520",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/530930/100/0/threaded",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90965",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/auracms/AuraCMS/commit/4fe9d0d31a32df392f4d6ced8e5c25ed4af19ade",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/auracms/AuraCMS/commit/790f66ffbc4f23a6e13636fc79d0aa1a7d81e747",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.htbridge.com/advisory/HTB23196",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://packetstormsecurity.com/files/125079",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/56804",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.exploit-db.com/exploits/31520",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/530930/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90965",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/auracms/AuraCMS/commit/4fe9d0d31a32df392f4d6ced8e5c25ed4af19ade",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/auracms/AuraCMS/commit/790f66ffbc4f23a6e13636fc79d0aa1a7d81e747",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.htbridge.com/advisory/HTB23196",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple SQL injection vulnerabilities in AuraCMS 2.3 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) search parameter to mod/content/content.php or (2) CLIENT_IP, (3) X_FORWARDED_FOR, (4) X_FORWARDED, (5) FORWARDED_FOR, or (6) FORWARDED HTTP header to index.php."
    },
    {
      "lang": "es",
      "value": "Múltiples vulnerabilidades de inyección SQL en AuraCMS 2.3 y anteriores permiten a usuarios autenticados ejecutar comandos SQL arbitrarios a través del (1) parámetro  search en mod/content/content.php  o  las cabeceras HTTP en (2) CLIENT_IP, (3) X_FORWARDED_FOR, (4) X_FORWARDED, (5) FORWARDED_FOR o (6) FORWARDED hacia index.php."
    }
  ],
  "lastModified": "2026-06-17T00:04:51.153",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:auracms:auracms:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "14620A04-7FEA-460D-8164-C809596EAA97",
              "versionEndIncluding": "2.3"
            },
            {
              "criteria": "cpe:2.3:a:auracms:auracms:1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F28DAF5D-6FB2-40A3-AE26-83B2B653CBE7"
            },
            {
              "criteria": "cpe:2.3:a:auracms:auracms:1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E5F58C57-054F-4C64-9B45-CC1B0A0ABA56"
            },
            {
              "criteria": "cpe:2.3:a:auracms:auracms:1.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6A7ADCAB-79C7-456C-A71B-C93C865B32D2"
            },
            {
              "criteria": "cpe:2.3:a:auracms:auracms:1.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1CD4278C-D878-47D8-8AFB-FB0C8FD79052"
            },
            {
              "criteria": "cpe:2.3:a:auracms:auracms:1.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "95C81747-2524-4F3A-94B6-BE5C7C8C1BEE"
            },
            {
              "criteria": "cpe:2.3:a:auracms:auracms:1.61:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0F49F7B4-6267-4BD5-AA97-0853A33DDA84"
            },
            {
              "criteria": "cpe:2.3:a:auracms:auracms:1.62:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0C93C4BB-2CC5-48AA-9440-A2C2199F6B06"
            },
            {
              "criteria": "cpe:2.3:a:auracms:auracms:2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "79834D18-B70E-4ADC-B458-EF26ED1016C2"
            },
            {
              "criteria": "cpe:2.3:a:auracms:auracms:2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1E62CD9C-DE5F-4E6D-9D37-A1B028C1D9DC"
            },
            {
              "criteria": "cpe:2.3:a:auracms:auracms:2.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7506B9A2-A20E-48D3-9809-8E4B34CB243E"
            },
            {
              "criteria": "cpe:2.3:a:auracms:auracms:2.2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CCAA5702-01AB-4238-A4A8-E890F5BDB20F"
            },
            {
              "criteria": "cpe:2.3:a:auracms:auracms:2.2.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "054E2EA6-5A0F-48D0-BB32-5F5DBDA312BE"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}