CVE-2014-9435

Severity: medium (CVSS 6.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2015-01-02 · updated 2026-06-17
Weakness: CWE-89

Description

Multiple SQL injection vulnerabilities in Absolut Engine 1.73 allow remote authenticated users to execute arbitrary SQL commands via the (1) sectionID parameter to admin/managersection.php, (2) userID parameter to admin/edituser.php, (3) username parameter to admin/admin.php, or (4) title parameter to admin/managerrelated.php.

Affected products

Absolutengine Absolut Engine: 1.73

References

http://seclists.org/fulldisclosure/2014/Dec/131
http://sroesemann.blogspot.de/2014/12/sroeadv-2014-08.html
http://www.securityfocus.com/bid/71822
http://seclists.org/fulldisclosure/2014/Dec/131
http://sroesemann.blogspot.de/2014/12/sroeadv-2014-08.html
http://www.securityfocus.com/bid/71822

Get alerted when CVE-2014-9435 or the next vulnerability affects your stack