CVE-2014-1206
Open Web Analytics 1.5.4 - 'owa_email_address' SQL Injection
Severity Score
7.5
*CVSS v2
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
4
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
SQL injection vulnerability in the password reset page in Open Web Analytics (OWA) before 1.5.5 allows remote attackers to execute arbitrary SQL commands via the owa_email_address parameter in a base.passwordResetRequest action to index.php.
Vulnerabilidad de inyección SQL en la página de reseteo de password de Open Web Analytics (OWA) anteriores a 1.5.5 permite a atacantes remotos ejecutar comandos SQL de forma arbitraria a través del parámetro owa_email_address en una acción base.passwordResetRequest en index.php.
Open Web Analytics (OWA) is open source web analytics software that can track and analyze how visitors use websites and applications. OWA is vulnerable to SQL injection that allows an attacker to execute arbitrary SQL statements in the context of the configured OWA database user without authenticating to the web application. This vulnerability affects Open Web Analytics version 1.5.4.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2014-01-07 CVE Reserved
- 2014-01-15 CVE Published
- 2014-02-18 First Exploit
- 2024-08-02 EPSS Updated
- 2024-08-06 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CAPEC
References (7)
| URL | Tag | Source |
|---|---|---|
| http://www.securityfocus.com/archive/1/531105/100/0/threaded | Mailing List |
| URL | Date | SRC |
|---|---|---|
| https://www.exploit-db.com/exploits/31738 | 2014-02-18 | |
| http://www.exploit-db.com/exploits/31738 | 2024-08-06 | |
| http://www.secureworks.com/advisories/SWRX-2014-001/SWRX-2014-001.pdf | 2024-08-06 | |
| http://www.securityfocus.com/bid/64774 | 2024-08-06 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://secunia.com/advisories/56350 | 2018-10-09 | |
| http://wiki.openwebanalytics.com/index.php?title=1.5.5 | 2018-10-09 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Openwebanalytics Search vendor "Openwebanalytics" | Open Web Analytics Search vendor "Openwebanalytics" for product "Open Web Analytics" | <= 1.5.4 Search vendor "Openwebanalytics" for product "Open Web Analytics" and version " <= 1.5.4" | - |
Affected
| ||||||
| Openwebanalytics Search vendor "Openwebanalytics" | Open Web Analytics Search vendor "Openwebanalytics" for product "Open Web Analytics" | 1.0 Search vendor "Openwebanalytics" for product "Open Web Analytics" and version "1.0" | - |
Affected
| ||||||
| Openwebanalytics Search vendor "Openwebanalytics" | Open Web Analytics Search vendor "Openwebanalytics" for product "Open Web Analytics" | 1.0.1 Search vendor "Openwebanalytics" for product "Open Web Analytics" and version "1.0.1" | - |
Affected
| ||||||
| Openwebanalytics Search vendor "Openwebanalytics" | Open Web Analytics Search vendor "Openwebanalytics" for product "Open Web Analytics" | 1.0.2 Search vendor "Openwebanalytics" for product "Open Web Analytics" and version "1.0.2" | - |
Affected
| ||||||
| Openwebanalytics Search vendor "Openwebanalytics" | Open Web Analytics Search vendor "Openwebanalytics" for product "Open Web Analytics" | 1.0.3 Search vendor "Openwebanalytics" for product "Open Web Analytics" and version "1.0.3" | - |
Affected
| ||||||
| Openwebanalytics Search vendor "Openwebanalytics" | Open Web Analytics Search vendor "Openwebanalytics" for product "Open Web Analytics" | 1.0.4 Search vendor "Openwebanalytics" for product "Open Web Analytics" and version "1.0.4" | - |
Affected
| ||||||
| Openwebanalytics Search vendor "Openwebanalytics" | Open Web Analytics Search vendor "Openwebanalytics" for product "Open Web Analytics" | 1.0.5 Search vendor "Openwebanalytics" for product "Open Web Analytics" and version "1.0.5" | - |
Affected
| ||||||
| Openwebanalytics Search vendor "Openwebanalytics" | Open Web Analytics Search vendor "Openwebanalytics" for product "Open Web Analytics" | 1.0.6 Search vendor "Openwebanalytics" for product "Open Web Analytics" and version "1.0.6" | - |
Affected
| ||||||
| Openwebanalytics Search vendor "Openwebanalytics" | Open Web Analytics Search vendor "Openwebanalytics" for product "Open Web Analytics" | 1.0.7 Search vendor "Openwebanalytics" for product "Open Web Analytics" and version "1.0.7" | - |
Affected
| ||||||
| Openwebanalytics Search vendor "Openwebanalytics" | Open Web Analytics Search vendor "Openwebanalytics" for product "Open Web Analytics" | 1.0.8 Search vendor "Openwebanalytics" for product "Open Web Analytics" and version "1.0.8" | - |
Affected
| ||||||
| Openwebanalytics Search vendor "Openwebanalytics" | Open Web Analytics Search vendor "Openwebanalytics" for product "Open Web Analytics" | 1.1.0 Search vendor "Openwebanalytics" for product "Open Web Analytics" and version "1.1.0" | rc1 |
Affected
| ||||||
| Openwebanalytics Search vendor "Openwebanalytics" | Open Web Analytics Search vendor "Openwebanalytics" for product "Open Web Analytics" | 1.1.0 Search vendor "Openwebanalytics" for product "Open Web Analytics" and version "1.1.0" | rc2 |
Affected
| ||||||
| Openwebanalytics Search vendor "Openwebanalytics" | Open Web Analytics Search vendor "Openwebanalytics" for product "Open Web Analytics" | 1.1.0 Search vendor "Openwebanalytics" for product "Open Web Analytics" and version "1.1.0" | rc3 |
Affected
| ||||||
| Openwebanalytics Search vendor "Openwebanalytics" | Open Web Analytics Search vendor "Openwebanalytics" for product "Open Web Analytics" | 1.1.0 Search vendor "Openwebanalytics" for product "Open Web Analytics" and version "1.1.0" | rc4 |
Affected
| ||||||
| Openwebanalytics Search vendor "Openwebanalytics" | Open Web Analytics Search vendor "Openwebanalytics" for product "Open Web Analytics" | 1.1.1 Search vendor "Openwebanalytics" for product "Open Web Analytics" and version "1.1.1" | - |
Affected
| ||||||
| Openwebanalytics Search vendor "Openwebanalytics" | Open Web Analytics Search vendor "Openwebanalytics" for product "Open Web Analytics" | 1.2.0 Search vendor "Openwebanalytics" for product "Open Web Analytics" and version "1.2.0" | - |
Affected
| ||||||
| Openwebanalytics Search vendor "Openwebanalytics" | Open Web Analytics Search vendor "Openwebanalytics" for product "Open Web Analytics" | 1.2.0 Search vendor "Openwebanalytics" for product "Open Web Analytics" and version "1.2.0" | rc1 |
Affected
| ||||||
| Openwebanalytics Search vendor "Openwebanalytics" | Open Web Analytics Search vendor "Openwebanalytics" for product "Open Web Analytics" | 1.2.0 Search vendor "Openwebanalytics" for product "Open Web Analytics" and version "1.2.0" | rc2 |
Affected
| ||||||
| Openwebanalytics Search vendor "Openwebanalytics" | Open Web Analytics Search vendor "Openwebanalytics" for product "Open Web Analytics" | 1.2.0 Search vendor "Openwebanalytics" for product "Open Web Analytics" and version "1.2.0" | rc3 |
Affected
| ||||||
| Openwebanalytics Search vendor "Openwebanalytics" | Open Web Analytics Search vendor "Openwebanalytics" for product "Open Web Analytics" | 1.2.1 Search vendor "Openwebanalytics" for product "Open Web Analytics" and version "1.2.1" | - |
Affected
| ||||||
| Openwebanalytics Search vendor "Openwebanalytics" | Open Web Analytics Search vendor "Openwebanalytics" for product "Open Web Analytics" | 1.2.1 Search vendor "Openwebanalytics" for product "Open Web Analytics" and version "1.2.1" | rc1 |
Affected
| ||||||
| Openwebanalytics Search vendor "Openwebanalytics" | Open Web Analytics Search vendor "Openwebanalytics" for product "Open Web Analytics" | 1.2.2 Search vendor "Openwebanalytics" for product "Open Web Analytics" and version "1.2.2" | - |
Affected
| ||||||
| Openwebanalytics Search vendor "Openwebanalytics" | Open Web Analytics Search vendor "Openwebanalytics" for product "Open Web Analytics" | 1.2.3 Search vendor "Openwebanalytics" for product "Open Web Analytics" and version "1.2.3" | - |
Affected
| ||||||
| Openwebanalytics Search vendor "Openwebanalytics" | Open Web Analytics Search vendor "Openwebanalytics" for product "Open Web Analytics" | 1.2.4 Search vendor "Openwebanalytics" for product "Open Web Analytics" and version "1.2.4" | - |
Affected
| ||||||
| Openwebanalytics Search vendor "Openwebanalytics" | Open Web Analytics Search vendor "Openwebanalytics" for product "Open Web Analytics" | 1.3.0 Search vendor "Openwebanalytics" for product "Open Web Analytics" and version "1.3.0" | - |
Affected
| ||||||
| Openwebanalytics Search vendor "Openwebanalytics" | Open Web Analytics Search vendor "Openwebanalytics" for product "Open Web Analytics" | 1.3.0 Search vendor "Openwebanalytics" for product "Open Web Analytics" and version "1.3.0" | rc1 |
Affected
| ||||||
| Openwebanalytics Search vendor "Openwebanalytics" | Open Web Analytics Search vendor "Openwebanalytics" for product "Open Web Analytics" | 1.3.1 Search vendor "Openwebanalytics" for product "Open Web Analytics" and version "1.3.1" | - |
Affected
| ||||||
| Openwebanalytics Search vendor "Openwebanalytics" | Open Web Analytics Search vendor "Openwebanalytics" for product "Open Web Analytics" | 1.4.0 Search vendor "Openwebanalytics" for product "Open Web Analytics" and version "1.4.0" | - |
Affected
| ||||||
| Openwebanalytics Search vendor "Openwebanalytics" | Open Web Analytics Search vendor "Openwebanalytics" for product "Open Web Analytics" | 1.4.0 Search vendor "Openwebanalytics" for product "Open Web Analytics" and version "1.4.0" | rc1 |
Affected
| ||||||
| Openwebanalytics Search vendor "Openwebanalytics" | Open Web Analytics Search vendor "Openwebanalytics" for product "Open Web Analytics" | 1.4.0 Search vendor "Openwebanalytics" for product "Open Web Analytics" and version "1.4.0" | rc2 |
Affected
| ||||||
| Openwebanalytics Search vendor "Openwebanalytics" | Open Web Analytics Search vendor "Openwebanalytics" for product "Open Web Analytics" | 1.4.0 Search vendor "Openwebanalytics" for product "Open Web Analytics" and version "1.4.0" | rc3 |
Affected
| ||||||
| Openwebanalytics Search vendor "Openwebanalytics" | Open Web Analytics Search vendor "Openwebanalytics" for product "Open Web Analytics" | 1.4.0 Search vendor "Openwebanalytics" for product "Open Web Analytics" and version "1.4.0" | rc4 |
Affected
| ||||||
| Openwebanalytics Search vendor "Openwebanalytics" | Open Web Analytics Search vendor "Openwebanalytics" for product "Open Web Analytics" | 1.4.1 Search vendor "Openwebanalytics" for product "Open Web Analytics" and version "1.4.1" | - |
Affected
| ||||||
| Openwebanalytics Search vendor "Openwebanalytics" | Open Web Analytics Search vendor "Openwebanalytics" for product "Open Web Analytics" | 1.5.0 Search vendor "Openwebanalytics" for product "Open Web Analytics" and version "1.5.0" | - |
Affected
| ||||||
| Openwebanalytics Search vendor "Openwebanalytics" | Open Web Analytics Search vendor "Openwebanalytics" for product "Open Web Analytics" | 1.5.0 Search vendor "Openwebanalytics" for product "Open Web Analytics" and version "1.5.0" | rc1 |
Affected
| ||||||
| Openwebanalytics Search vendor "Openwebanalytics" | Open Web Analytics Search vendor "Openwebanalytics" for product "Open Web Analytics" | 1.5.0 Search vendor "Openwebanalytics" for product "Open Web Analytics" and version "1.5.0" | rc2 |
Affected
| ||||||
| Openwebanalytics Search vendor "Openwebanalytics" | Open Web Analytics Search vendor "Openwebanalytics" for product "Open Web Analytics" | 1.5.0 Search vendor "Openwebanalytics" for product "Open Web Analytics" and version "1.5.0" | rc3 |
Affected
| ||||||
| Openwebanalytics Search vendor "Openwebanalytics" | Open Web Analytics Search vendor "Openwebanalytics" for product "Open Web Analytics" | 1.5.1 Search vendor "Openwebanalytics" for product "Open Web Analytics" and version "1.5.1" | - |
Affected
| ||||||
| Openwebanalytics Search vendor "Openwebanalytics" | Open Web Analytics Search vendor "Openwebanalytics" for product "Open Web Analytics" | 1.5.2 Search vendor "Openwebanalytics" for product "Open Web Analytics" and version "1.5.2" | - |
Affected
| ||||||
| Openwebanalytics Search vendor "Openwebanalytics" | Open Web Analytics Search vendor "Openwebanalytics" for product "Open Web Analytics" | 1.5.3 Search vendor "Openwebanalytics" for product "Open Web Analytics" and version "1.5.3" | - |
Affected
| ||||||