CVE-2015-6004 SQL injection in n/a
Remote attackers can execute arbitrary SQL commands via vulnerable parameters in IPSwitch WhatsUp Gold, potentially compromising database integrity and confidentiality.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2015-6004?
CVE-2015-6004 is a medium-severity SQL injection vulnerability in Progress Whatsup Gold, published on 27 Dec 2015. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Multiple SQL injection vulnerabilities in IPSwitch WhatsUp Gold before 16.4 allow remote attackers to execute arbitrary SQL commands via (1) the UniqueID (aka sUniqueID) parameter to WrFreeFormText.asp in the Reports component or (2) the Find Device parameter.
Weakness: CWE-89
Which versions are affected by CVE-2015-6004?
It affects 1 product.
Products include Progress Whatsup Gold.
How do I fix CVE-2015-6004?
No fix has been published for CVE-2015-6004 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2015-6004 being exploited?
There is no known exploitation of CVE-2015-6004 in the wild and no public exploit code.
Other vulnerabilities in Progress Whatsup Gold
- CVE-2024-6670 Progress WhatsUp Gold SQL Injection
- CVE-2024-4885 Progress WhatsUp Gold Path Traversal
- CVE-2024-46909 WhatsUp Gold WriteDataFile Directory Traversal Remote Code Execution Vulnerability
- CVE-2024-8785 WhatsUp Gold Registry Overwrite Remote Code Execution Vulnerability
- CVE-2024-7763 WhatsUp Gold getReport Missing Authentication Authentication Bypass Vulnerability
Sources
Also known as GHSA-q7r8-6fcq-p76p.