Vulnerability Details CVE-2015-6004
Multiple SQL injection vulnerabilities in IPSwitch WhatsUp Gold before 16.4 allow remote attackers to execute arbitrary SQL commands via (1) the UniqueID (aka sUniqueID) parameter to WrFreeFormText.asp in the Reports component or (2) the Find Device parameter.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.169
EPSS Ranking 94.6%
CVSS Severity
CVSS v3 Score 6.5
CVSS v2 Score 6.5
References
- http://twitter.com/ipswitch/statuses/677558623229317121
- http://www.securityfocus.com/bid/79506
- http://www.securitytracker.com/id/1034833
- https://community.rapid7.com/community/infosec/blog/2015/12/16/multiple-disclosures-for-multiple-network-management-systems
- https://www.kb.cert.org/vuls/id/176160
- http://twitter.com/ipswitch/statuses/677558623229317121
- http://www.securityfocus.com/bid/79506
- http://www.securitytracker.com/id/1034833
- https://community.rapid7.com/community/infosec/blog/2015/12/16/multiple-disclosures-for-multiple-network-management-systems
- https://www.kb.cert.org/vuls/id/176160
Products affected by CVE-2015-6004
-
cpe:2.3:a:progress:whatsup_gold:-
-
cpe:2.3:a:progress:whatsup_gold:11
-
cpe:2.3:a:progress:whatsup_gold:15.02
-
cpe:2.3:a:progress:whatsup_gold:16.3
-
cpe:2.3:a:progress:whatsup_gold:7.0
-
cpe:2.3:a:progress:whatsup_gold:7.03
-
cpe:2.3:a:progress:whatsup_gold:7.04
-
cpe:2.3:a:progress:whatsup_gold:8.0
-
cpe:2.3:a:progress:whatsup_gold:8.01
-
cpe:2.3:a:progress:whatsup_gold:8.03