JVNDB-2009-000005

MODx vulnerable to SQL injection

MODx, an open source contents management system, contains a SQL injection vulnerability.

MODx, an open source contents management system, contains a SQL injection vulnerability in the MODx Control Panel.

Gaku Mochizuki of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

Base Metrics: 5.1 (Medium) [IPA Score]

• Access Vector: Network
• Access Complexity: High
• Authentication: None
• Confidentiality Impact: Partial
• Integrity Impact: Partial
• Availability Impact: Partial

MODx

• MODx 0.9.6.2 and earlier

A remote attacker could obtain administrative privileges of MODx.

[Update the Software]
Apply the latest update provided by the developer.

MODx

• MODx : MODx CMS and PHP Application Framework
• MODx : Get MODx Here - Latest Stable Release
• MODx : ChangeLog

1. JVN : JVN#72630020
2. National Vulnerability Database (NVD) : CVE-2008-5940
3. Common Vulnerabilities and Exposures (CVE) : CVE-2008-5940
4. Secunia Advisory : SA33405
5. SecurityFocus : 33182
6. ISS X-Force Database : 47840
7. Common Weakness Enumeration (CWE) : SQL Injection (CWE-89) [IPA Evaluation]
8. JVN iPedia (Japanese) : JVNDB-2009-000005

[2009/01/09]
  Web page published