Vulnerability Description
SQL injection vulnerability in the "Users management" functionality in SeedDMS (formerly LetoDMS and MyDMS) before 5.1.8 allows authenticated attackers to manipulate an SQL query within the application by sending additional SQL commands to the application server. An attacker can use this vulnerability to perform malicious tasks such as to extract, change, or delete sensitive information within the database supporting the application, and potentially run system commands on the underlying operating system.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Seeddms | Seeddms | < 5.1.8 |
Related Weaknesses (CWE)
References
- https://sourceforge.net/p/seeddms/code/ci/seeddms-5.1.x/tree/CHANGELOGPatchRelease NotesThird Party Advisory
- https://www.contextis.com/resources/advisories/cve-2018-12942PatchThird Party Advisory
- https://sourceforge.net/p/seeddms/code/ci/seeddms-5.1.x/tree/CHANGELOGPatchRelease NotesThird Party Advisory
- https://www.contextis.com/resources/advisories/cve-2018-12942PatchThird Party Advisory
FAQ
What is CVE-2018-12942?
CVE-2018-12942 is a vulnerability with a CVSS score of 8.8 (HIGH). SQL injection vulnerability in the "Users management" functionality in SeedDMS (formerly LetoDMS and MyDMS) before 5.1.8 allows authenticated attackers to manipulate an SQL query within the applicatio...
How severe is CVE-2018-12942?
CVE-2018-12942 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-12942?
Check the references section above for vendor advisories and patch information. Affected products include: Seeddms Seeddms.