Vulnerabilities

TI-2017-11294 CVE-2017-15381 · GHSA-grxx-hc63-h45x

SQL Injection exists in E-Sic 1.0 via the f parameter to…

MEDIUM 45

SQL Injection exists in E-Sic 1.0 via the f parameter to esiclivre/restrito/inc/buscacep.php (aka the zip code search script).

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01482 Published 2017-10-23 No fix listed CWE-89

TI-2017-11293 CVE-2017-15380 · GHSA-jxqv-8prh-c98f

LOW 29

XSS exists in the E-Sic 1.0 /cadastro/index.php URI (aka the requester's registration area) via the nome parameter.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00818 Published 2017-10-23 No fix listed CWE-79

TI-2017-11292 CVE-2017-15379 · GHSA-fj7f-rgcf-77qm

MEDIUM 47

An authentication bypass exists in the E-Sic 1.0 /index (aka login) URI via '=''or' values for the username and password.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.0273 Published 2017-10-23 No fix listed CWE-89

TI-2017-11291 CVE-2017-15378 · GHSA-v2q5-6v56-46r3

MEDIUM 41

SQL Injection exists in the E-Sic 1.0 password reset parameter (aka the cpfcnpj parameter to the /reset URI).

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.01403 Published 2017-10-23 No fix listed CWE-89

TI-2017-11286 CVE-2017-15373 · GHSA-gwhp-hcwr-wmwv

MEDIUM 45

E-Sic 1.0 allows SQL injection via the q parameter to esiclivre/restrito/inc/lkpcep.php (aka the search private area).

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01706 Published 2017-10-16 No fix listed CWE-89