Description

In install/page_dbsettings.php in the Core distribution of XOOPS 2.5.8.1, unfiltered data passed to CREATE and ALTER SQL queries caused SQL Injection in the database settings page, related to use of GBK in CHARACTER SET and COLLATE clauses.

Remediation

References

CVE-2017-11174

Related Vulnerabilities

WordPress Plugin Smart Forms-when you need more than just a contact form Cross-Site Scripting (2.6.15)

WordPress Plugin Oi Yandex.Maps for WordPress Cross-Site Scripting (3.2.7)

WordPress Plugin Admin Columns Pro Cross-Site Scripting (5.5.1)

MyBB Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2016-9418)

WordPress 4.4.x Prototype Pollution (4.4 - 4.4.26)

Severity

Critical

Classification

CVE-2017-11174 CWE-138 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities