« Volver al listado

CVE-2017-12585

Estado: ModificadaAlta (8.8)—

SLiMS 8 Akasia through 8.3.1 has SQL injection in admin/AJAX_lookup_handler.php (tableName and tableFields parameters), admin/AJAX_check_id.php, and admin/AJAX_vocabolary_control.php. It can be exploited by remote authenticated librarian users.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Slims — Akasia

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-12585",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-08-06T03:29:00.307",
  "references": [
    {
      "url": "https://github.com/slims/slims8_akasia/issues/47",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/slims/slims8_akasia/issues/47",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "SLiMS 8 Akasia through 8.3.1 has SQL injection in admin/AJAX_lookup_handler.php (tableName and tableFields parameters), admin/AJAX_check_id.php, and admin/AJAX_vocabolary_control.php. It can be exploited by remote authenticated librarian users."
    },
    {
      "lang": "es",
      "value": "SLiMS 8 Akasia en su versión 8.3.1 tiene una inyección SQL en admin/AJAX_lookup_handler.php (parámetros tableName y tableFields), admin/AJAX_check_id.php y admin/AJAX_vocabolary_control.php. Esta vulnerabilidad puede ser explotada por usuarios remotos de librería autenticados."
    }
  ],
  "lastModified": "2026-06-17T01:03:33.133",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:slims:akasia:8.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E9D9E614-A634-4769-B76D-0D1E1E693275"
            },
            {
              "criteria": "cpe:2.3:a:slims:akasia:8.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "382402AC-A381-447A-9C5A-5280D4632835"
            },
            {
              "criteria": "cpe:2.3:a:slims:akasia:8.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BDD6A532-C370-49C6-95C8-5543F50A5963"
            },
            {
              "criteria": "cpe:2.3:a:slims:akasia:8.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "98C6AF7D-5966-40BC-855E-ED15EA126622"
            },
            {
              "criteria": "cpe:2.3:a:slims:akasia:8.3.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3F979A52-EBEF-470C-B226-ADC5A3B65EC2"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}