CVE-2018-1000558

Severity: medium (CVSS 6.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-06-26 · updated 2026-06-17
Weakness: CWE-89

Description

OCS Inventory NG ocsreports 2.4 and ocsreports 2.3.1 version 2.4 and 2.3.1 contains a SQL Injection vulnerability in web search that can result in An authenticated attacker is able to gain full access to data stored within database. This attack appear to be exploitable via By sending crafted requests it is possible to gain database access. This vulnerability appears to have been fixed in 2.4.1.

Affected products

Ocsinventory-Ng Ocsinventory Ng: 2.3.1, 2.4

References

https://www.ocsinventory-ng.org/en/ocs-inventory-server-2-4-1-has-been-released/
https://www.secuvera.de/advisories/secuvera-SA-2017-04.txt
https://www.ocsinventory-ng.org/en/ocs-inventory-server-2-4-1-has-been-released/
https://www.secuvera.de/advisories/secuvera-SA-2017-04.txt

Get alerted when CVE-2018-1000558 or the next vulnerability affects your stack