CVE-2013-3727

HIGH 7.5CVE-2013-3727 · Published 13/03/2014 · updated 16/06/2026

In short

CVE-2013-3727 is a HIGH (CVSS 7.5) vulnerability affecting kasseler-cms (kasseler-cms).
Chance of exploitation in the next 30 days (EPSS): 2.9%, higher than 87.0% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
kasseler-cms kasseler-cms	`≤ 2`	No fix yet

Description

SQL injection vulnerability in Kasseler CMS before 2 r1232 allows remote authenticated users to execute arbitrary SQL commands via the groups[] parameter to admin.php. NOTE: this can be leveraged using CSRF to allow remote unauthenticated attackers to execute arbitrary SQL commands.

References

diff.kasseler-cms.net/svn.html
diff.kasseler-cms.net/svn/patches/1232.html · Vendor Advisory
osvdb.org/94779
packetstormsecurity.com/files/122282/Kasseler-CMS-2-r1223-CSRF-XSS-SQL-Injection.html · Exploit
seclists.org/bugtraq/2013/Jul/26
exchange.xforce.ibmcloud.com/vulnerabilities/85407
htbridge.com/advisory/HTB23158

More vulnerabilities in kasseler-cms

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free