CVE-2015-8298

Multiple SQL injection vulnerabilities in the login page in RXTEC RXAdmin UPDATE 06 / 2012 allow remote attackers to execute arbitrary SQL commands via the (1) loginpassword, (2) loginusername, (3) zusatzlicher, or (4) groupid parameter to index.htm, or the (5) rxtec cookie to index.htm.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
mitreCNA
---
---
CVEADP
---
---
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 87%
Common Weakness Enumeration
References
http://packetstormsecurity.com/files/134525/RXTEC-RXAdmin-SQL-Injection.html
http://seclists.org/fulldisclosure/2015/Nov/90
https://github.com/sbaresearch/advisories/tree/public/2015/RXTEC_20150513
http://packetstormsecurity.com/files/134525/RXTEC-RXAdmin-SQL-Injection.html
http://seclists.org/fulldisclosure/2015/Nov/90
https://github.com/sbaresearch/advisories/tree/public/2015/RXTEC_20150513