CVE-2013-2559
published 2014-03-27CVE-2013-2559: SQL injection vulnerability in Symphony CMS before 2.3.2 allows remote authenticated users to execute arbitrary SQL commands via the sort parameter to…
PriorityP343medium6.5CVSS 2.0
AVNACLAuSCPIPAP
EXPLOIT
EPSS
2.35%
81.6th percentile
SQL injection vulnerability in Symphony CMS before 2.3.2 allows remote authenticated users to execute arbitrary SQL commands via the sort parameter to system/authors/. NOTE: this can be leveraged using CSRF to allow remote unauthenticated attackers to execute arbitrary SQL commands.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| getsymphony | symphony | <= 2.3.1 | — |
| getsymphony | symphony | — | — |
| getsymphony | symphony | — | — |
| getsymphony | symphony | — | — |
| getsymphony | symphony | — | — |
| getsymphony | symphony | — | — |
| getsymphony | symphony | — | — |
| getsymphony | symphony | — | — |
| getsymphony | symphony | — | — |
| getsymphony | symphony | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Symphony CMS up to 2.3.1 sort sql injection (EDB-38417 / XFDB-83227)
vuldb·2026-05-09·CVSS 6.5
CVE-2013-2559 [MEDIUM] Symphony CMS up to 2.3.1 sort sql injection (EDB-38417 / XFDB-83227)
A vulnerability was found in Symphony CMS up to 2.3.1. It has been declared as problematic. This affects an unknown function. Such manipulation of the argument sort leads to sql injection.
This vulnerability is referenced as CVE-2013-2559. It is possible to launch the attack remotely. Furthermore, an exploit is available.
It is recommended to upgrade the affected component.
GHSA
GHSA-4vx2-wjfv-v48h: SQL injection vulnerability in Symphony CMS before 2
ghsa_unreviewed·2022-05-13
CVE-2013-2559 [MEDIUM] CWE-89 GHSA-4vx2-wjfv-v48h: SQL injection vulnerability in Symphony CMS before 2
SQL injection vulnerability in Symphony CMS before 2.3.2 allows remote authenticated users to execute arbitrary SQL commands via the sort parameter to system/authors/. NOTE: this can be leveraged using CSRF to allow remote unauthenticated attackers to execute arbitrary SQL commands.
GHSA
GHSA-975c-4jj8-2jx7: Cross-site request forgery (CSRF) vulnerability in Symphony CMS before 2
ghsa_unreviewed·2022-05-13·CVSS 6.5
CVE-2013-7346 [MEDIUM] CWE-352 GHSA-975c-4jj8-2jx7: Cross-site request forgery (CSRF) vulnerability in Symphony CMS before 2
Cross-site request forgery (CSRF) vulnerability in Symphony CMS before 2.3.2 allows remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the sort parameter to system/authors/, related to CVE-2013-2559.
No detection rules found.
No writeups or analysis indexed.
http://archives.neohapsis.com/archives/bugtraq/2013-04/0018.htmlhttp://www.getsymphony.com/download/releases/version/2.3.2http://www.securityfocus.com/bid/58843https://exchange.xforce.ibmcloud.com/vulnerabilities/83227https://github.com/symphonycms/symphony-2/commit/6c8aa4e9c810994f7632837487426867ce50f468https://www.htbridge.com/advisory/HTB23148http://archives.neohapsis.com/archives/bugtraq/2013-04/0018.htmlhttp://www.getsymphony.com/download/releases/version/2.3.2http://www.securityfocus.com/bid/58843https://exchange.xforce.ibmcloud.com/vulnerabilities/83227https://github.com/symphonycms/symphony-2/commit/6c8aa4e9c810994f7632837487426867ce50f468https://www.htbridge.com/advisory/HTB23148
2014-03-27
Published