製品・ソフトウェアに関する情報

JVN脆弱性詳細

OrangeHRM における SQL インジェクションの脆弱性

Title	OrangeHRM における SQL インジェクションの脆弱性
Summary	OrangeHRM の lib/controllers/CentralController.php には、SQL インジェクションの脆弱性が存在します。
Possible impacts	第三者により、id パラメータを介して、任意の SQL コマンドを実行される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Feb. 12, 2013, midnight
Registration Date	Feb. 15, 2013, 6:59 p.m.
Last Update	Feb. 15, 2013, 6:59 p.m.

Affected System

OrangeHRM

OrangeHRM 2.6.11.2 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2011-5259	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-5259
National Vulnerability Database (NVD)
2	CVE-2011-5259	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-5259

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-89	https://jvndb.jvn.jp/ja/cwe/CWE-89.html

ベンダー情報

No	Name	URL
OrangeHRM
1	Security Vulnerabilities Fixed with OrangeHRM 2.6.11.2	http://blog.orangehrm.com/2011/12/09/security-vulnerabilities-fixed-with-orangehrm-26112/
2	Top Page	http://www.orangehrm.com/home.shtml

Change Log

No	Changed Details	Date of change
0	[2013年02月15日] 掲載	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2011-5259

Summary	SQL injection vulnerability in lib/controllers/CentralController.php in OrangeHRM before 2.6.11.2 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Publication Date	Feb. 13, 2013, 5:55 a.m.
Registration Date	Jan. 28, 2021, 4:40 p.m.
Last Update	Nov. 21, 2024, 10:34 a.m.

Affected software configurations

Related information, measures and tools

No	URL	タグ
1	http://blog.orangehrm.com/2011/12/09/security-vulnerabilities-fixed-with-orangehrm-26112/	Vendor Advisory
2	http://osvdb.org/show/osvdb/77418	Exploit
3	http://secunia.com/advisories/47014	Vendor Advisory
4	http://www.securityfocus.com/archive/1/520684/100/0/threaded
5	http://www.securityfocus.com/bid/50857
6	https://exchange.xforce.ibmcloud.com/vulnerabilities/71569
7	https://www.htbridge.ch/advisory/multiple_vulnerabilities_in_orangehrm.html
8	http://blog.orangehrm.com/2011/12/09/security-vulnerabilities-fixed-with-orangehrm-26112/	Vendor Advisory
9	https://www.htbridge.ch/advisory/multiple_vulnerabilities_in_orangehrm.html
10	https://exchange.xforce.ibmcloud.com/vulnerabilities/71569
11	http://www.securityfocus.com/bid/50857
12	http://www.securityfocus.com/archive/1/520684/100/0/threaded
13	http://secunia.com/advisories/47014	Vendor Advisory
14	http://osvdb.org/show/osvdb/77418	Exploit

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-89	SQLインジェクション	https://cwe.mitre.org/data/definitions/89.html