CVE-2015-10053 prodigasistemas curupira passwords_controller.rb sql injection
Attackers can execute arbitrary SQL commands via the passwords controller, potentially reading or modifying data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2015-10053?
CVE-2015-10053 is a medium-severity SQL injection vulnerability in prodigasistemas curupira, published on 16 Jan 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability classified as critical has been found in prodigasistemas curupira up to 0.1.3. Affected is an unknown function of the file app/controllers/curupira/passwords_controller.rb. The manipulation leads to sql injection. Upgrading to version 0.1.4 is able to address this issue. The patch is identified as 93a9a77896bb66c949acb8e64bceafc74bc8c271. It is recommended to upgrade the affected component. VDB-218394 is the identifier assigned to this vulnerability.
Weakness: CWE-89
Which versions are affected by CVE-2015-10053?
2 open source packages ship an affected version, including curupira. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
curupira RubyGems | All versions | 0.1.4 |
curupira RubyGems | All versions | 0.1.4 |
Products include Prodigasistemas Curupira.
How do I fix CVE-2015-10053?
Upgrade curupira to 0.1.4 or later.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2015-10053 being exploited?
There is no known exploitation of CVE-2015-10053 in the wild and no public exploit code.
Sources
Also known as GHSA-85gf-wr67-f83w.