DBRisinajumi d2files SQL Injection vulnerability

CRÍTICO 9.8CVE-2015-10018 · GHSA-68hv-8926-j34c · Published 06/01/2023 · updated 17/06/2026

En resumen

CVE-2015-10018 es una vulnerabilidad CRÍTICO (CVSS 9.8) que afecta a dbrisinajumi/d2files, d2files (weberp).
Probabilidad de explotación en los próximos 30 días (EPSS): 0.71%, mayor que el 53.5% de las vulnerabilidades.
Solución: actualizar a 1.0.0 o posterior.

Package	Affected versions	Patched versions
dbrisinajumi/d2files Packagist	`< 1.0.0`	`1.0.0`
d2files weberp	`< 1.0.0`	`1.0.0`

Description

A vulnerability has been found in DBRisinajumi d2files and classified as critical. Affected by this vulnerability is the function actionUpload/actionDownloadFile of the file controllers/D2filesController.php. The manipulation leads to sql injection. Upgrading to version 1.0.0 can address this issue. The name of the patch is b5767f2ec9d0f3cbfda7f13c84740e2179c90574. It is recommended to upgrade the affected component. The identifier VDB-217561 was assigned to this vulnerability.

NVD description

A vulnerability has been found in DBRisinajumi d2files and classified as critical. Affected by this vulnerability is the function actionUpload/actionDownloadFile of the file controllers/D2filesController.php. The manipulation leads to sql injection. Upgrading to version 1.0.0 is able to address this issue. The identifier of the patch is b5767f2ec9d0f3cbfda7f13c84740e2179c90574. It is recommended to upgrade the affected component. The identifier VDB-217561 was assigned to this vulnerability.

References

nvd.nist.gov/vuln/detail/CVE-2015-10018 · ADVISORY
DBRisinajumi/d2files commit b5767f2 · WEB
DBRisinajumi/d2files · PACKAGE
DBRisinajumi/d2files release 1.0.0 · WEB
vuldb.com · WEB
vuldb.com · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

dbrisinajumi/d2files

Packagist

< 1.0.0

1.0.0

d2files

weberp

< 1.0.0

1.0.0

Description

NVD description