CVE-2013-7189 EXPLOIT
7.5
HIGH · CVSS 2.0 · EPSS 1.3% (pctl 70)
Patch early
A public exploit exists.
Description
Multiple SQL injection vulnerabilities in iScripts AutoHoster, possibly 2.4, allow remote attackers to execute arbitrary SQL commands via the cmbdomain parameter to (1) checktransferstatus.php, (2) checktransferstatusbck.php, or (3) additionalsettings.php; or (4) invno parameter to payinvoiceothers.php.
Scoring
| CVSS | 7.5 (HIGH, v2.0) |
|---|---|
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| EPSS | 1.32% — more likely to be exploited than 70% of all CVEs |
| Weakness | CWE-89 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2013-12-20 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| iscripts | autohoster |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | iScripts AutoHoster - 'checktransferstatus.php' SQL Injection | 2013-12-15 |
| exploit-db | iScripts AutoHoster - 'checktransferstatusbck.php' SQL Injection | 2013-12-15 |
| exploit-db | iScripts AutoHoster - 'additionalsettings.php' SQL Injection | 2013-12-15 |
| exploit-db | iScripts AutoHoster - 'invno' SQL Injection | 2013-12-15 |
References
- http://osvdb.org/101049
- http://osvdb.org/101050
- http://osvdb.org/101051
- http://osvdb.org/101053
- http://seclists.org/fulldisclosure/2013/Dec/121
- https://exchange.xforce.ibmcloud.com/vulnerabilities/89816
- http://osvdb.org/101049
- http://osvdb.org/101050
- http://osvdb.org/101051
- http://osvdb.org/101053
- http://seclists.org/fulldisclosure/2013/Dec/121
- https://exchange.xforce.ibmcloud.com/vulnerabilities/89816
→ the Explorer · watch your stack · NVD