CVEvulnerability
CVE-2014-8351
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2014-11-06
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-89
Description
SQL injection vulnerability in info.php in French National Commission on Informatics and Liberty (aka CNIL) CookieViz before 1.0.1 allows remote web servers to execute arbitrary SQL commands via the domain parameter.
Affected configurations
• french national commission on informatics and liberty cookieviz (<= 1.0)
Related
Weakness · CWE (1)
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness
References
- http://packetstormsecurity.com/files/128960/CNIL-CookieViz-Cross-Site-Scripting-SQL-Injection.html Exploit
- http://seclists.org/fulldisclosure/2014/Nov/3 Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/98454 exchange.xforce.ibmcloud.com
- https://github.com/LaboCNIL/CookieViz/commit/489b6050f6c53fe7b24c4bed3eeb9c25543960e2 Patch
- http://packetstormsecurity.com/files/128960/CNIL-CookieViz-Cross-Site-Scripting-SQL-Injection.html Exploit
- http://seclists.org/fulldisclosure/2014/Nov/3 Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/98454 exchange.xforce.ibmcloud.com
- https://github.com/LaboCNIL/CookieViz/commit/489b6050f6c53fe7b24c4bed3eeb9c25543960e2 Patch