Summary
Detail | |||
---|---|---|---|
Vendor | Doorgets | First view | 2014-02-11 |
Product | Doorgets Cms | Last view | 2019-04-30 |
Version | Type | Application | |
Update | |||
Edition | |||
Language | |||
Sofware Edition | |||
Target Software | |||
Target Hardware | |||
Other |
Activity : Overall
COMMON PLATFORM ENUMERATION: Repartition per Version
CPE Name | Affected CVE |
---|---|
cpe:2.3:a:doorgets:doorgets_cms:7.0:*:*:*:*:*:*:* | 21 |
cpe:2.3:a:doorgets:doorgets_cms:3.0:*:*:*:*:*:*:* | 1 |
cpe:2.3:a:doorgets:doorgets_cms:4.0:*:*:*:*:*:*:* | 1 |
Related : CVE
Date | Alert | Description | |
---|---|---|---|
5.3 | 2019-04-30 | CVE-2019-11626 | routers/ajaxRouter.php in doorGets 7.0 has a web site physical path leakage vulnerability, as demonstrated by an ajax/index.php?uri=1234%5c request. |
4.9 | 2019-04-30 | CVE-2019-11625 | doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/requests/user/emailingRequest.php. A remote background administrator privilege user (or a user with permission to manage emailing) could exploit the vulnerability to obtain database sensitive information. |
4.9 | 2019-04-30 | CVE-2019-11624 | doorGets 7.0 has an arbitrary file deletion vulnerability in /doorgets/app/requests/user/configurationRequest.php. A remote background administrator privilege user can exploit this vulnerability to delete arbitrary files. |
4.9 | 2019-04-30 | CVE-2019-11623 | doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/requests/user/configurationRequest.php when action=siteweb. A remote background administrator privilege user (or a user with permission to manage configuration siteweb) could exploit the vulnerability to obtain database sensitive information. |
4.9 | 2019-04-30 | CVE-2019-11622 | doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/requests/user/modulecategoryRequest.php. A remote background administrator privilege user (or a user with permission to manage modulecategory) could exploit the vulnerability to obtain database sensitive information via modulecategory_edit_titre. |
4.9 | 2019-04-30 | CVE-2019-11621 | doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/requests/user/configurationRequest.php when action=network. A remote background administrator privilege user (or a user with permission to manage network configuration) could exploit the vulnerability to obtain database sensitive information. |
4.9 | 2019-04-30 | CVE-2019-11620 | doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/requests/user/modulecategoryRequest.php. A remote background administrator privilege user (or a user with permission to manage modulecategory) could exploit the vulnerability to obtain database sensitive information via modulecategory_add_titre. |
4.9 | 2019-04-30 | CVE-2019-11619 | doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/requests/user/configurationRequest.php when action=analytics. A remote background administrator privilege user (or a user with permission to manage configuration analytics) could exploit the vulnerability to obtain database sensitive information. |
9.8 | 2019-04-30 | CVE-2019-11618 | doorGets 7.0 has a default administrator credential vulnerability. A remote attacker can use this vulnerability to gain administrator privileges for the creation and modification of articles via an H0XZlT44FcN1j9LTdFc5XRXhlF30UaGe1g3cZY6i1K9 access_token in a uri=blog&action=index&controller=blog action to /api/index.php. |
8.8 | 2019-04-30 | CVE-2019-11617 | doorGets 7.0 has a CSRF vulnerability in /doorgets/app/requests/user/configurationRequest.php. A remote attacker can exploit this vulnerability for "Google Analytics code" modification. |
9.8 | 2019-04-30 | CVE-2019-11616 | doorGets 7.0 has a sensitive information disclosure vulnerability in /setup/temp/admin.php and /setup/temp/database.php. A remote unauthenticated attacker could exploit this vulnerability to obtain the administrator password. |
8.8 | 2019-04-30 | CVE-2019-11615 | /fileman/php/upload.php in doorGets 7.0 has an arbitrary file upload vulnerability. A remote normal registered user can use this vulnerability to upload backdoor files to control the server. |
7.5 | 2019-04-30 | CVE-2019-11614 | doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/views/ajax/commentView.php. A remote unauthorized attacker could exploit the vulnerability to obtain database sensitive information. |
6.5 | 2019-04-30 | CVE-2019-11613 | doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/views/ajax/contactView.php. A remote normal registered user could exploit the vulnerability to obtain database sensitive information. |
7.5 | 2019-04-30 | CVE-2019-11612 | doorGets 7.0 has an arbitrary file deletion vulnerability in /fileman/php/deletefile.php. A remote unauthenticated attacker can exploit this vulnerability to delete arbitrary files. |
7.5 | 2019-04-30 | CVE-2019-11611 | doorGets 7.0 has a sensitive information disclosure vulnerability in /fileman/php/download.php. A remote unauthenticated attacker can exploit this vulnerability to obtain server-sensitive information. |
7.5 | 2019-04-30 | CVE-2019-11610 | doorGets 7.0 has a sensitive information disclosure vulnerability in /fileman/php/downloaddir.php. A remote unauthenticated attacker can exploit this vulnerability to obtain server-sensitive information. |
8.2 | 2019-04-30 | CVE-2019-11609 | doorGets 7.0 has a sensitive information disclosure vulnerability in /fileman/php/movefile.php. A remote unauthenticated attacker can exploit this vulnerability to obtain server-sensitive information or make the server unserviceable. |
8.2 | 2019-04-30 | CVE-2019-11608 | doorGets 7.0 has a sensitive information disclosure vulnerability in /fileman/php/renamefile.php. A remote unauthenticated attacker can exploit this vulnerability to obtain server-sensitive information or make the server unserviceable. |
7.5 | 2019-04-30 | CVE-2019-11607 | doorGets 7.0 has a sensitive information disclosure vulnerability in /fileman/php/copydir.php. A remote unauthenticated attacker can exploit this vulnerability to obtain server-sensitive information. |
7.5 | 2019-04-30 | CVE-2019-11606 | doorGets 7.0 has a sensitive information disclosure vulnerability in /fileman/php/copyfile.php. A remote unauthenticated attacker can exploit this vulnerability to obtain server-sensitive information. |
6.5 | 2014-02-11 | CVE-2014-1459 | SQL injection vulnerability in dg-admin/index.php in doorGets CMS 5.2 and earlier allows remote authenticated administrators to execute arbitrary SQL commands via the _position_down_id parameter. NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands. |
CWE : Common Weakness Enumeration
% | id | Name |
---|---|---|
45% (9) | CWE-89 | Improper Sanitization of Special Elements used in an SQL Command ('... |
40% (8) | CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path ... |
5% (1) | CWE-434 | Unrestricted Upload of File with Dangerous Type |
5% (1) | CWE-352 | Cross-Site Request Forgery (CSRF) |
5% (1) | CWE-21 | Pathname Traversal and Equivalence Errors |
ExploitDB Exploits
id | Description |
---|---|
31521 | doorGets CMS 5.2 - SQL Injection Vulnerability |