How severe is CVE-2017-5218?

This vulnerability has a severity rating of HIGH with a CVSS score of 8.8 out of 10.

What type of vulnerability is CVE-2017-5218?

This is classified as CWE-89, which is a common weakness in software security.

CVE-2017-5218 - HIGH Severity | CVSS 8.8

Vulnerability Description

A SQL Injection issue was discovered in SageCRM 7.x before 7.3 SP3. The AP_DocumentUI.asp web resource includes Utilityfuncs.js when the file is opened or viewed. This file crafts a SQL statement to identify the database that is to be in use with the current user's session. The database variable can be populated from the URL, and when supplied non-expected characters, can be manipulated to obtain access to the underlying database. The /CRM/CustomPages/ACCPAC/AP_DocumentUI.asp?SID=<VALID-SID>&database=1';WAITFOR DELAY '0:0:5'-- URI is a Proof of Concept.

Related Vulnerabilities

CVE-2007-10003

HIGH

CVSS:8.8(High)

A vulnerability, which was classified as critical, has been found in The Hackers Diet Plugin up to 0.9.6b on WordPress. This issue affects some unknown processing of the file ajax_blurb.php of the com...

CWE-892007

CVE-2010-3662

HIGH

CVSS:8.8(High)

TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows SQL Injection on the backend.

CWE-892010

CVE-2011-0467

HIGH

CVSS:8.8(High)

A vulnerability in the listing of available software of SUSE Studio Onsite, SUSE Studio Onsite 1.1 Appliance allows authenticated users to execute arbitrary SQL statements via SQL injection. Affected ...

CWE-892011

CVE-2012-4383

HIGH

CVSS:8.8(High)

contao prior to 2.11.4 has a sql injection vulnerability

CWE-892012

CVE-2012-5698

HIGH

CVSS:8.8(High)

BabyGekko before 1.2.4 has SQL injection.

CWE-892012

CVE-2013-3638

HIGH

CVSS:8.8(High)

SQL injection vulnerability in Boonex Dolphin before 7.1.3 allows remote authenticated users to execute arbitrary SQL commands via the 'pathes' parameter in 'categories.php'.

CWE-892013