CVE-2010-4894 - Vulnerability Details - OpenCVE

SQL injection vulnerability in core/showsite.php in chillyCMS 1.1.3 allows remote attackers to execute arbitrary SQL commands via the name parameter. NOTE: some of these details are obtained from third party information.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Chillycms	Chillycms

Configuration 1 [-]

cpe:2.3:a:chillycms:chillycms:1.1.3:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://osvdb.org/67836
http://packetstormsecurity.org/1009-exploits/chillycms-sqlxss.txt
http://secunia.com/advisories/41313
http://securityreason.com/securityalert/8437
http://www.bugreport.ir/index_73.htm
http://www.exploit-db.com/exploits/14897
http://www.securityfocus.com/bid/42991
http://www.vupen.com/english/advisories/2010/2298
https://exchange.xforce.ibmcloud.com/vulnerabilities/61606

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2011-10-08T10:00:00

Updated: 2024-08-07T04:02:29.999Z

Reserved: 2011-10-07T00:00:00

Link: CVE-2010-4894

Vulnrichment

No data.

NVD

Status : Modified

Published: 2011-10-08T10:55:05.393

Modified: 2024-11-21T01:22:00.773

Link: CVE-2010-4894

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2010-09-05T00:00:00", "descriptions": [{"lang": "en", "value": "SQL injection vulnerability in core/showsite.php in chillyCMS 1.1.3 allows remote attackers to execute arbitrary SQL commands via the name parameter. NOTE: some of these details are obtained from third party information."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-08-28T12:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "http://www.bugreport.ir/index_73.htm"}, {"name": "67836", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/67836"}, {"name": "14897", "tags": ["exploit", "x_refsource_EXPLOIT-DB"], "url": "http://www.exploit-db.com/exploits/14897"}, {"name": "chillycms-show-sql-injection(61606)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/61606"}, {"name": "8437", "tags": ["third-party-advisory", "x_refsource_SREASON"], "url": "http://securityreason.com/securityalert/8437"}, {"tags": ["x_refsource_MISC"], "url": "http://packetstormsecurity.org/1009-exploits/chillycms-sqlxss.txt"}, {"name": "ADV-2010-2298", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2010/2298"}, {"name": "42991", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/42991"}, {"name": "41313", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/41313"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2010-4894", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "SQL injection vulnerability in core/showsite.php in chillyCMS 1.1.3 allows remote attackers to execute arbitrary SQL commands via the name parameter. NOTE: some of these details are obtained from third party information."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "http://www.bugreport.ir/index_73.htm", "refsource": "MISC", "url": "http://www.bugreport.ir/index_73.htm"}, {"name": "67836", "refsource": "OSVDB", "url": "http://osvdb.org/67836"}, {"name": "14897", "refsource": "EXPLOIT-DB", "url": "http://www.exploit-db.com/exploits/14897"}, {"name": "chillycms-show-sql-injection(61606)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/61606"}, {"name": "8437", "refsource": "SREASON", "url": "http://securityreason.com/securityalert/8437"}, {"name": "http://packetstormsecurity.org/1009-exploits/chillycms-sqlxss.txt", "refsource": "MISC", "url": "http://packetstormsecurity.org/1009-exploits/chillycms-sqlxss.txt"}, {"name": "ADV-2010-2298", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2010/2298"}, {"name": "42991", "refsource": "BID", "url": "http://www.securityfocus.com/bid/42991"}, {"name": "41313", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/41313"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T04:02:29.999Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://www.bugreport.ir/index_73.htm"}, {"name": "67836", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://osvdb.org/67836"}, {"name": "14897", "tags": ["exploit", "x_refsource_EXPLOIT-DB", "x_transferred"], "url": "http://www.exploit-db.com/exploits/14897"}, {"name": "chillycms-show-sql-injection(61606)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/61606"}, {"name": "8437", "tags": ["third-party-advisory", "x_refsource_SREASON", "x_transferred"], "url": "http://securityreason.com/securityalert/8437"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://packetstormsecurity.org/1009-exploits/chillycms-sqlxss.txt"}, {"name": "ADV-2010-2298", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2010/2298"}, {"name": "42991", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/42991"}, {"name": "41313", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/41313"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2010-4894", "datePublished": "2011-10-08T10:00:00", "dateReserved": "2011-10-07T00:00:00", "dateUpdated": "2024-08-07T04:02:29.999Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:chillycms:chillycms:1.1.3:*:*:*:*:*:*:*", "matchCriteriaId": "42ADA921-AF99-44E3-A08C-3C8C7A3F2031", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "SQL injection vulnerability in core/showsite.php in chillyCMS 1.1.3 allows remote attackers to execute arbitrary SQL commands via the name parameter. NOTE: some of these details are obtained from third party information."}, {"lang": "es", "value": "Vulnerabilidad de inyecci\u00f3n SQL en el n\u00facleo/showsite.php en chillyCMS v1.1.3 permite a atacantes remotos ejecutar comandos SQL a trav\u00e9s del par\u00e1metro name. NOTA: algunos de estos detalles han sido obtenidos de informaci\u00f3n de terceros."}], "id": "CVE-2010-4894", "lastModified": "2024-11-21T01:22:00.773", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2011-10-08T10:55:05.393", "references": [{"source": "cve@mitre.org", "url": "http://osvdb.org/67836"}, {"source": "cve@mitre.org", "url": "http://packetstormsecurity.org/1009-exploits/chillycms-sqlxss.txt"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/41313"}, {"source": "cve@mitre.org", "url": "http://securityreason.com/securityalert/8437"}, {"source": "cve@mitre.org", "url": "http://www.bugreport.ir/index_73.htm"}, {"source": "cve@mitre.org", "url": "http://www.exploit-db.com/exploits/14897"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/42991"}, {"source": "cve@mitre.org", "url": "http://www.vupen.com/english/advisories/2010/2298"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/61606"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://osvdb.org/67836"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://packetstormsecurity.org/1009-exploits/chillycms-sqlxss.txt"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/41313"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://securityreason.com/securityalert/8437"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.bugreport.ir/index_73.htm"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.exploit-db.com/exploits/14897"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/42991"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.vupen.com/english/advisories/2010/2298"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/61606"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "nvd@nist.gov", "type": "Primary"}]}