CVE-2014-1459

Published February 11th, 2014

View on NVD ↗

CVSS v3

N/A

CVSS v2

6.5

MEDIUM

Affected

PROJECT

Description

SQL injection vulnerability in dg-admin/index.php in doorGets CMS 5.2 and earlier allows remote authenticated administrators to execute arbitrary SQL commands via the _position_down_id parameter. NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands.

doorgets/doorGets

CMS PHP doorGets offers a free, fully scalable, Open-source CMS PHP Website solution.

GitHub