Unscored severity · published Apr 24, 2014
CVE-2014-2736
Multiple SQL injection vulnerabilities in MODX Revolution before 2.2.14 allow remote attackers to execute arbitrary SQL commands via the (1) session ID (PHPSESSID) to index.php or…
–
CVSS
1.2%
EPSS
No
On KEV
Description
Multiple SQL injection vulnerabilities in MODX Revolution before 2.2.14 allow remote attackers to execute arbitrary SQL commands via the (1) session ID (PHPSESSID) to index.php or remote authenticated users to execute arbitrary SQL commands via the (2) user parameter to connectors/security/message.php or (3) id parameter to manager/index.php.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 69% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MR
Modx Revolution · Modx
through 2.2.13; 2.0.0; 2.0.1; 2.0.3; 2.0.4; 2.0.5; +22 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-2736
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-2736
archives.neohapsis.com
http://archives.neohapsis.com/archives/bugtraq/2014-04/0124.html
Vendor Advisory
http://forums.modx.com/thread/90173/modx-revolution-2-2-13-and-prior-blind-sql-injection
Vendor Advisory
http://secunia.com/advisories/58036
www.securityfocus.com
http://www.securityfocus.com/bid/66990
More from Modx Revolution
9.8
CVE-2017-7324
setup/templates/findcore.php in MODX Revolution 2.5.4-pl and earlier allows remote attackers to execute arbitrary PHP code via the core_path parameter
9.8
CVE-2017-7321
setup/controllers/welcome.php in MODX Revolution 2.5.4-pl and earlier allows remote attackers to execute arbitrary PHP code via the config_key parameter to the…
9.1
CVE-2020-25911
A XML External Entity (XXE) vulnerability was discovered in the modRestServiceRequest component in MODX CMS 2.7.3 which can lead to an information disclosure or denial of service…
8.8
CVE-2017-9069
In MODX Revolution before 2.5.7, a user with file upload permissions is able to execute arbitrary code by uploading a file with the name .htaccess
8.1
CVE-2017-7323
The (1) update and (2) package-installation features in MODX Revolution 2.5.4-pl and earlier use http://rest.modx.com by default, which allows man-in-the-middle attackers to spoof…