Vulnerability-Lookup

CNVD-2016-11357

Vulnerability from cnvd - Published: 2016-11-21

Title

Moxa SoftCMS SQL注入漏洞

Description

Moxa SoftCMS是摩莎（Moxa）公司开发的一套适用于大型监控系统的中央管理软件。该软件支持实时视频监控、录像回放和事件管理等。 Moxa SoftCMS 1.6之前的版本中存在SQL注入漏洞。攻击者利用漏洞可运行任意代码，应用程序因被过度消费资源而导致拒绝服务条件，访问或修改数据，或在底层数据库利用潜在的漏洞，获取数据库管理员权限。

Severity

高

Patch Name

Moxa SoftCMS SQL注入漏洞的补丁

Patch Description

Formal description

厂商已提供漏洞修补方案，请关注厂商主页及时更新： http://www.moxa.com

Reference

http://www.securityfocus.com/bid/94394

Impacted products

Name
['Moxa SoftCMS 1.4', 'Moxa SoftCMS 1.3', 'Moxa SoftCMS 1.2', 'Moxa SoftCMS 1.5']

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "94394"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2016-9333"
    }
  },
  "description": "Moxa SoftCMS\u662f\u6469\u838e\uff08Moxa\uff09\u516c\u53f8\u5f00\u53d1\u7684\u4e00\u5957\u9002\u7528\u4e8e\u5927\u578b\u76d1\u63a7\u7cfb\u7edf\u7684\u4e2d\u592e\u7ba1\u7406\u8f6f\u4ef6\u3002\u8be5\u8f6f\u4ef6\u652f\u6301\u5b9e\u65f6\u89c6\u9891\u76d1\u63a7\u3001\u5f55\u50cf\u56de\u653e\u548c\u4e8b\u4ef6\u7ba1\u7406\u7b49\u3002\r\n\r\nMoxa SoftCMS 1.6\u4e4b\u524d\u7684\u7248\u672c\u4e2d\u5b58\u5728SQL\u6ce8\u5165\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u5229\u7528\u6f0f\u6d1e\u53ef\u8fd0\u884c\u4efb\u610f\u4ee3\u7801\uff0c\u5e94\u7528\u7a0b\u5e8f\u56e0\u88ab\u8fc7\u5ea6\u6d88\u8d39\u8d44\u6e90\u800c\u5bfc\u81f4\u62d2\u7edd\u670d\u52a1\u6761\u4ef6\uff0c\u8bbf\u95ee\u6216\u4fee\u6539\u6570\u636e\uff0c\u6216\u5728\u5e95\u5c42\u6570\u636e\u5e93\u5229\u7528\u6f5c\u5728\u7684\u6f0f\u6d1e\uff0c\u83b7\u53d6\u6570\u636e\u5e93\u7ba1\u7406\u5458\u6743\u9650\u3002",
  "discovererName": "Zhou Yu working with Trend Micro\u00e2??s Zero Day Initiative and Gu Ziqiang from Huawei Weiran Labs.",
  "formalWay": "\u5382\u5546\u5df2\u63d0\u4f9b\u6f0f\u6d1e\u4fee\u8865\u65b9\u6848\uff0c\u8bf7\u5173\u6ce8\u5382\u5546\u4e3b\u9875\u53ca\u65f6\u66f4\u65b0\uff1a\r\nhttp://www.moxa.com",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2016-11357",
  "openTime": "2016-11-21",
  "patchDescription": "Moxa SoftCMS\u662f\u6469\u838e\uff08Moxa\uff09\u516c\u53f8\u5f00\u53d1\u7684\u4e00\u5957\u9002\u7528\u4e8e\u5927\u578b\u76d1\u63a7\u7cfb\u7edf\u7684\u4e2d\u592e\u7ba1\u7406\u8f6f\u4ef6\u3002\u8be5\u8f6f\u4ef6\u652f\u6301\u5b9e\u65f6\u89c6\u9891\u76d1\u63a7\u3001\u5f55\u50cf\u56de\u653e\u548c\u4e8b\u4ef6\u7ba1\u7406\u7b49\u3002\r\n\r\nMoxa SoftCMS 1.6\u4e4b\u524d\u7684\u7248\u672c\u4e2d\u5b58\u5728SQL\u6ce8\u5165\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u5229\u7528\u6f0f\u6d1e\u53ef\u8fd0\u884c\u4efb\u610f\u4ee3\u7801\uff0c\u5e94\u7528\u7a0b\u5e8f\u56e0\u88ab\u8fc7\u5ea6\u6d88\u8d39\u8d44\u6e90\u800c\u5bfc\u81f4\u62d2\u7edd\u670d\u52a1\u6761\u4ef6\uff0c\u8bbf\u95ee\u6216\u4fee\u6539\u6570\u636e\uff0c\u6216\u5728\u5e95\u5c42\u6570\u636e\u5e93\u5229\u7528\u6f5c\u5728\u7684\u6f0f\u6d1e\uff0c\u83b7\u53d6\u6570\u636e\u5e93\u7ba1\u7406\u5458\u6743\u9650\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Moxa SoftCMS SQL\u6ce8\u5165\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Moxa SoftCMS 1.4",
      "Moxa SoftCMS  1.3",
      "Moxa SoftCMS  1.2",
      "Moxa SoftCMS 1.5"
    ]
  },
  "referenceLink": "http://www.securityfocus.com/bid/94394",
  "serverity": "\u9ad8",
  "submitTime": "2016-11-19",
  "title": "Moxa SoftCMS SQL\u6ce8\u5165\u6f0f\u6d1e"
}

CVE-2016-9333 (GCVE-0-2016-9333)

Vulnerability from cvelistv5 – Published: 2017-02-13 21:00 – Updated: 2024-08-06 02:50

Summary

An issue was discovered in Moxa SoftCMS versions prior to Version 1.6. The SoftCMS Application does not properly sanitize input that may allow a remote attacker access to SoftCMS with administrator's privilege through specially crafted input (SQL INJECTION).

Severity

No CVSS data available.

CWE

Moxa SoftCMS SQL INJECTION

Assigner

icscert CNA under the icscert root

CNA scorecard B 75/100 over 342 records in the last 180 days details

References

2 references

URL	Tags
https://ics-cert.us-cert.gov/advisories/ICSA-16-322-02	x_refsource_MISC
http://www.securityfocus.com/bid/94394	vdb-entryx_refsource_BID

Impacted products

1 product

Vendor	Product	Version
n/a	Moxa SoftCMS prior to Version 1.6	Affected: Moxa SoftCMS prior to Version 1.6

Date Public

2017-02-13 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T02:50:36.963Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://ics-cert.us-cert.gov/advisories/ICSA-16-322-02"
          },
          {
            "name": "94394",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/94394"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Moxa SoftCMS prior to Version 1.6",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Moxa SoftCMS prior to Version 1.6"
            }
          ]
        }
      ],
      "datePublic": "2017-02-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue was discovered in Moxa SoftCMS versions prior to Version 1.6. The SoftCMS Application does not properly sanitize input that may allow a remote attacker access to SoftCMS with administrator\u0027s privilege through specially crafted input (SQL INJECTION)."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Moxa SoftCMS SQL INJECTION",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-02-14T10:57:01.000Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://ics-cert.us-cert.gov/advisories/ICSA-16-322-02"
        },
        {
          "name": "94394",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/94394"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "ics-cert@hq.dhs.gov",
          "ID": "CVE-2016-9333",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Moxa SoftCMS prior to Version 1.6",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Moxa SoftCMS prior to Version 1.6"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An issue was discovered in Moxa SoftCMS versions prior to Version 1.6. The SoftCMS Application does not properly sanitize input that may allow a remote attacker access to SoftCMS with administrator\u0027s privilege through specially crafted input (SQL INJECTION)."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Moxa SoftCMS SQL INJECTION"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://ics-cert.us-cert.gov/advisories/ICSA-16-322-02",
              "refsource": "MISC",
              "url": "https://ics-cert.us-cert.gov/advisories/ICSA-16-322-02"
            },
            {
              "name": "94394",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/94394"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2016-9333",
    "datePublished": "2017-02-13T21:00:00.000Z",
    "dateReserved": "2016-11-16T00:00:00.000Z",
    "dateUpdated": "2024-08-06T02:50:36.963Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted