WEB APPLICATION VULNERABILITIES Standard & Premium

Roundcube Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2013-6172)

Description

steps/utils/save_pref.inc in Roundcube webmail before 0.8.7 and 0.9.x before 0.9.5 allows remote attackers to modify configuration settings via the _session parameter, which can be leveraged to read arbitrary files, conduct SQL injection attacks, and execute arbitrary code.

Remediation

References

Related Vulnerabilities

PrestaShop Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2012-2517)

MySQL CVE-2017-3638 Vulnerability (CVE-2017-3638)

Atlassian Confluence Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2016-6283)

MediaWiki Other Vulnerability (CVE-2005-2215)

WordPress Plugin Check & Log Email Cross-Site Scripting (0.3)

Severity

High

Classification

CVE-2013-6172 CWE-138

Tags

Missing Update Known Vulnerabilities