Frontaccounting Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2018-1000890)

Description

FrontAccounting 2.4.5 contains a Time Based Blind SQL Injection vulnerability in the parameter "filterType" in /attachments.php that can allow the attacker to grab the entire database of the application.

Remediation

References

CVE-2018-1000890

Related Vulnerabilities

Grafana Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2022-23498)

Zikula Improper Neutralization of Special Elements used in a Command ('Command Injection') Vulnerability (CVE-2016-9835)

WordPress Plugin OnePress Social Locker Multiple Cross-Site Scripting Vulnerabilities (4.2.0)

WordPress Plugin WP Gravity Forms Zendesk Cross-Site Scripting (1.0.7)

Jboss EAP Improper Input Validation Vulnerability (CVE-2013-2185)

Severity

High

Classification

CVE-2018-1000890 CWE-138 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N