{"vuid":"VU#110532","idnumber":"110532","name":"Subrion CMS vulnerable to SQL injection by an authenticated user","keywords":["sql injection","cms","sqli"],"overview":"Subrion CMS is vulnerable to SQL injection from authenticated users when a browser cookie is modified in a certain way.","clean_desc":"Subrion is an open source web-based content management system (CMS). Subrion is vulnerable to SQL injection due to deserialization of untrusted data from a browser cookie. CWE-502: Deserialization of Untrusted Data\nCWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Upon user login, Subrion attempts to locate a cookie named salt and deserialize the cookie for use in SQL UPDATE statements when interacting with Subrion. Modifying this cookie in a certain way may result in arbitrary SQL statements being executed on Subrion's underlying database. This issue is verified in version 3.3.0. Other versions prior to 3.3.3 may also be affected. The reporter suggests versions as early as 3.1.1 may be affected.","impact":"An authenticated remote user may execute arbitrary SQL statements on Subrion's database.","resolution":"Apply an update Subrion has released version 3.3.3 addressing this issue. Affected users are encouraged to update as soon as possible.","workarounds":"","sysaffected":"","thanks":"Thanks to Jack Baker for reporting this vulnerability to us, and to Subrion for quickly addressing this issue.","author":"This document was written by Garret Wassermann.","public":["h","t","t","p",":","/","/","w","w","w",".","s","u","b","r","i","o","n",".","o","r","g","/","f","o","r","u","m","s","/","t","h","r","e","a","d","s","/","s","u","b","r","i","o","n","-","c","m","s","-","3","-","3","-","3","-","i","s","-","a","v","a","i","l","a","b","l","e",".","2","0","2","4","/"],"cveids":[""],"certadvisory":"","uscerttechnicalalert":null,"datecreated":"2015-03-16T11:58:49Z","publicdate":"2015-04-27T00:00:00Z","datefirstpublished":"2015-05-08T14:44:34Z","dateupdated":"2015-05-08T14:44:34Z","revision":48,"vrda_d1_directreport":"1","vrda_d1_population":"3","vrda_d1_impact":"3","cam_widelyknown":"0","cam_exploitation":"0","cam_internetinfrastructure":"0","cam_population":"0","cam_impact":"0","cam_easeofexploitation":"0","cam_attackeraccessrequired":"0","cam_scorecurrent":"0","cam_scorecurrentwidelyknown":"0","cam_scorecurrentwidelyknownexploited":"0","ipprotocol":"","cvss_accessvector":"N","cvss_accesscomplexity":"L","cvss_authentication":null,"cvss_confidentialityimpact":"C","cvss_integrityimpact":"C","cvss_availabilityimpact":"C","cvss_exploitablity":null,"cvss_remediationlevel":"OF","cvss_reportconfidence":"C","cvss_collateraldamagepotential":"ND","cvss_targetdistribution":"M","cvss_securityrequirementscr":"ND","cvss_securityrequirementsir":"ND","cvss_securityrequirementsar":"ND","cvss_basescore":"9","cvss_basevector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","cvss_temporalscore":"7","cvss_environmentalscore":"5.3044065648","cvss_environmentalvector":"CDP:ND/TD:M/CR:ND/IR:ND/AR:ND","metric":0.0,"vulnote":null}