CVE-2018-1000867

{"id": "CVE-2018-1000867", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2018-12-20T17:29:00.567", "references": [{"url": "http://bugs.webidsupport.com/view.php?id=647", "tags": ["Issue Tracking", "Release Notes", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/renlok/WeBid/commit/256a5f9d3eafbc477dcf77c7682446cc4b449c7f", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "https://telekomsecurity.github.io/assets/advisories/20181108_WeBid_Multiple_Vulnerabilities.txt", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "WeBid version up to current version 1.2.2 contains a SQL Injection vulnerability in All five yourauctions*.php scripts that can result in Database Read via Blind SQL Injection. This attack appear to be exploitable via HTTP Request. This vulnerability appears to have been fixed in after commit 256a5f9d3eafbc477dcf77c7682446cc4b449c7f."}, {"lang": "es", "value": "WeBid, hasta la actual versi\u00f3n 1.2.2, contiene una vulnerabilidad de inyecci\u00f3n SQL en los 5 scripts yourauctions*.php que puede resultar en la lectura de la base de datos mediante una inyecci\u00f3n SQL ciega. Este ataque parece ser explotable mediante una petici\u00f3n HTTP. La vulnerabilidad parece haber sido solucionada tras el commit con ID 256a5f9d3eafbc477dcf77c7682446cc4b449c7f."}], "lastModified": "2019-01-07T20:59:46.633", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:webidsupport:webid:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9EAC0F5C-741F-49B1-B5E0-DE5CF6E1303B", "versionEndIncluding": "1.2.2"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}