CVE-2013-5321 EXPLOIT
7.5
HIGH · CVSS 2.0 · EPSS 1.4% (pctl 71)
Patch early
A public exploit exists.
Description
Multiple SQL injection vulnerabilities in AlienVault Open Source Security Information Management (OSSIM) 4.1 allow remote attackers to execute arbitrary SQL commands via the (1) sensor parameter in a Query action to forensics/base_qry_main.php; the (2) tcp_flags[] or (3) tcp_port[0][4] parameter to forensics/base_stat_alerts.php; the (4) ip_addr[1][8] or (5) port_type parameter to forensics/base_stat_ports.php; or the (6) sortby or (7) rvalue parameter in a search action to vulnmeter/index.php.
Scoring
| CVSS | 7.5 (HIGH, v2.0) |
|---|---|
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| EPSS | 1.37% — more likely to be exploited than 71% of all CVEs |
| Weakness | CWE-89 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2013-08-20 |
| Last modified | 2026-06-16 |
Affected (1)
| Vendor | Product |
|---|---|
| alienvault | open source security information management |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Alienvault Open Source SIEM (OSSIM) 4.1 - Multiple SQL Injection Vulnerabilities | 2013-06-24 |
→ the Explorer · watch your stack · NVD