github - ghsa-vw4j-wqq5-5pv6

ghsa-vw4j-wqq5-5pv6

Vulnerability from github

Published

2023-02-06 00:30

Modified

2023-02-12 06:30

Severity ?

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

A vulnerability, which was classified as critical, has been found in Gimmie Plugin 1.2.2. This issue affects some unknown processing of the file trigger_referral.php. The manipulation of the argument referrername leads to sql injection. Upgrading to version 1.3.0 is able to address this issue. The name of the patch is 7194a09353dd24a274678383a4418f2fd3fce6f7. It is recommended to upgrade the affected component. The identifier VDB-220205 was assigned to this vulnerability.

Show details on source website

JSON

To clipboard

{
   affected: [],
   aliases: [
      "CVE-2014-125084",
   ],
   database_specific: {
      cwe_ids: [
         "CWE-89",
      ],
      github_reviewed: false,
      github_reviewed_at: null,
      nvd_published_at: "2023-02-06T00:15:00Z",
      severity: "CRITICAL",
   },
   details: "A vulnerability, which was classified as critical, has been found in Gimmie Plugin 1.2.2. This issue affects some unknown processing of the file trigger_referral.php. The manipulation of the argument referrername leads to sql injection. Upgrading to version 1.3.0 is able to address this issue. The name of the patch is 7194a09353dd24a274678383a4418f2fd3fce6f7. It is recommended to upgrade the affected component. The identifier VDB-220205 was assigned to this vulnerability.",
   id: "GHSA-vw4j-wqq5-5pv6",
   modified: "2023-02-12T06:30:27Z",
   published: "2023-02-06T00:30:32Z",
   references: [
      {
         type: "ADVISORY",
         url: "https://nvd.nist.gov/vuln/detail/CVE-2014-125084",
      },
      {
         type: "WEB",
         url: "https://github.com/gimmie/vbulletin-v4/commit/7194a09353dd24a274678383a4418f2fd3fce6f7",
      },
      {
         type: "WEB",
         url: "https://github.com/gimmie/vbulletin-v4/tree/v1.3.0",
      },
      {
         type: "WEB",
         url: "https://vuldb.com/?ctiid.220205",
      },
      {
         type: "WEB",
         url: "https://vuldb.com/?id.220205",
      },
   ],
   schema_version: "1.4.0",
   severity: [
      {
         score: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
         type: "CVSS_V3",
      },
   ],
}

cve-2014-125084

Vulnerability from cvelistv5

Published

2023-02-05 23:57

Modified

2024-08-06 14:10

Severity ?

5.5 (Medium) - CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
5.5 (Medium) - CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Summary

A vulnerability, which was classified as critical, has been found in Gimmie Plugin 1.2.2 on vBulletin. This issue affects some unknown processing of the file trigger_referral.php. The manipulation of the argument referrername leads to sql injection. Upgrading to version 1.3.0 is able to address this issue. The identifier of the patch is 7194a09353dd24a274678383a4418f2fd3fce6f7. It is recommended to upgrade the affected component. The identifier VDB-220205 was assigned to this vulnerability.

References

▼	URL	Tags
	https://vuldb.com/?id.220205	vdb-entry, technical-description
	https://vuldb.com/?ctiid.220205	signature, permissions-required
	https://github.com/gimmie/vbulletin-v4/commit/7194a09353dd24a274678383a4418f2fd3fce6f7	patch
	https://github.com/gimmie/vbulletin-v4/tree/v1.3.0	patch

Impacted products

	Vendor	Product	Version
	n/a	Gimmie Plugin	Version: 1.2.2

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-06T14:10:56.667Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "vdb-entry",
                     "technical-description",
                     "x_transferred",
                  ],
                  url: "https://vuldb.com/?id.220205",
               },
               {
                  tags: [
                     "signature",
                     "permissions-required",
                     "x_transferred",
                  ],
                  url: "https://vuldb.com/?ctiid.220205",
               },
               {
                  tags: [
                     "patch",
                     "x_transferred",
                  ],
                  url: "https://github.com/gimmie/vbulletin-v4/commit/7194a09353dd24a274678383a4418f2fd3fce6f7",
               },
               {
                  tags: [
                     "patch",
                     "x_transferred",
                  ],
                  url: "https://github.com/gimmie/vbulletin-v4/tree/v1.3.0",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "Gimmie Plugin",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "1.2.2",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               type: "tool",
               value: "VulDB GitHub Commit Analyzer",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A vulnerability, which was classified as critical, has been found in Gimmie Plugin 1.2.2 on vBulletin. This issue affects some unknown processing of the file trigger_referral.php. The manipulation of the argument referrername leads to sql injection. Upgrading to version 1.3.0 is able to address this issue. The identifier of the patch is 7194a09353dd24a274678383a4418f2fd3fce6f7. It is recommended to upgrade the affected component. The identifier VDB-220205 was assigned to this vulnerability.",
            },
            {
               lang: "de",
               value: "Eine Schwachstelle wurde in Gimmie Plugin 1.2.2 für vBulletin entdeckt. Sie wurde als kritisch eingestuft. Davon betroffen ist unbekannter Code der Datei trigger_referral.php. Durch das Manipulieren des Arguments referrername mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Ein Aktualisieren auf die Version 1.3.0 vermag dieses Problem zu lösen. Der Patch wird als 7194a09353dd24a274678383a4418f2fd3fce6f7 bezeichnet. Als bestmögliche Massnahme wird das Einspielen eines Upgrades empfohlen.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  baseScore: 5.5,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
                  version: "3.1",
               },
            },
            {
               cvssV3_0: {
                  baseScore: 5.5,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
                  version: "3.0",
               },
            },
            {
               cvssV2_0: {
                  baseScore: 5.2,
                  vectorString: "AV:A/AC:L/Au:S/C:P/I:P/A:P",
                  version: "2.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-89",
                     description: "CWE-89 SQL Injection",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-10-20T06:55:43.926Z",
            orgId: "1af790b2-7ee1-4545-860a-a788eba489b5",
            shortName: "VulDB",
         },
         references: [
            {
               tags: [
                  "vdb-entry",
                  "technical-description",
               ],
               url: "https://vuldb.com/?id.220205",
            },
            {
               tags: [
                  "signature",
                  "permissions-required",
               ],
               url: "https://vuldb.com/?ctiid.220205",
            },
            {
               tags: [
                  "patch",
               ],
               url: "https://github.com/gimmie/vbulletin-v4/commit/7194a09353dd24a274678383a4418f2fd3fce6f7",
            },
            {
               tags: [
                  "patch",
               ],
               url: "https://github.com/gimmie/vbulletin-v4/tree/v1.3.0",
            },
         ],
         timeline: [
            {
               lang: "en",
               time: "2023-02-04T00:00:00.000Z",
               value: "Advisory disclosed",
            },
            {
               lang: "en",
               time: "2023-02-04T00:00:00.000Z",
               value: "CVE reserved",
            },
            {
               lang: "en",
               time: "2023-02-04T01:00:00.000Z",
               value: "VulDB entry created",
            },
            {
               lang: "en",
               time: "2023-03-05T08:48:27.000Z",
               value: "VulDB entry last update",
            },
         ],
         title: "Gimmie Plugin trigger_referral.php sql injection",
      },
   },
   cveMetadata: {
      assignerOrgId: "1af790b2-7ee1-4545-860a-a788eba489b5",
      assignerShortName: "VulDB",
      cveId: "CVE-2014-125084",
      datePublished: "2023-02-05T23:57:03.158Z",
      dateReserved: "2023-02-04T22:07:56.465Z",
      dateUpdated: "2024-08-06T14:10:56.667Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted