CVEvulnerability
CVE-2015-8298
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2018-09-24
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 9.8 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-89
Description
Multiple SQL injection vulnerabilities in the login page in RXTEC RXAdmin UPDATE 06 / 2012 allow remote attackers to execute arbitrary SQL commands via the (1) loginpassword, (2) loginusername, (3) zusatzlicher, or (4) groupid parameter to index.htm, or the (5) rxtec cookie to index.htm.
Affected configurations
• rxtec rxadmin 2012
Related
Weakness · CWE (1)
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness
References
- http://packetstormsecurity.com/files/134525/RXTEC-RXAdmin-SQL-Injection.html Exploit, Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2015/Nov/90 Mailing List, Third Party Advisory
- https://github.com/sbaresearch/advisories/tree/public/2015/RXTEC_20150513 Third Party Advisory
- http://packetstormsecurity.com/files/134525/RXTEC-RXAdmin-SQL-Injection.html Exploit, Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2015/Nov/90 Mailing List, Third Party Advisory
- https://github.com/sbaresearch/advisories/tree/public/2015/RXTEC_20150513 Third Party Advisory