CVE-2013-2050 SQL injection in n/a

What is CVE-2013-2050?

CVE-2013-2050 is a high-severity SQL injection vulnerability in n/a, published on 11 Jan 2014. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

SQL injection vulnerability in the miq_policy controller in Red Hat CloudForms 2.0 Management Engine (CFME) 5.1 and ManageIQ Enterprise Virtualization Manager 5.0 and earlier allows remote authenticated users to execute arbitrary SQL commands via the profile[] parameter in an explorer action.

Weakness: CWE-89

Which versions are affected by CVE-2013-2050?

It affects 2 products.

Products include Redhat Cloudforms Management Engine, Redhat Manageiq Enterprise Virtualization Manager.

How do I fix CVE-2013-2050?

Apply the vendor's patch.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2013-2050 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2013-2050 exists.

Public exploit code: 1 Metasploit module.

Other vulnerabilities in n/a

• CVE-2013-2068 Path traversal in n/a Critical 9.4
• CVE-2014-8164 Security feature bypass in Red Hat CloudForms Critical 9.1
• CVE-2020-14324 Command injection in CloudForms Critical 9.1
• CVE-2014-0087 Missing authorization in n/a High 8.8
• CVE-2016-7040 Command injection in n/a High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-h3r2-9qhv-2vw2.