CVE-2013-3727
published 2014-03-13CVE-2013-3727: SQL injection vulnerability in Kasseler CMS before 2 r1232 allows remote authenticated users to execute arbitrary SQL commands via the groups[] parameter to…
PriorityP346high7.5CVSS 2.0
AVNACLAuNCPIPAP
EXPLOIT
EPSS
2.92%
85.3th percentile
SQL injection vulnerability in Kasseler CMS before 2 r1232 allows remote authenticated users to execute arbitrary SQL commands via the groups[] parameter to admin.php. NOTE: this can be leveraged using CSRF to allow remote unauthenticated attackers to execute arbitrary SQL commands.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| kasseler-cms | kasseler-cms | <= 2 | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Kasseler-cms 2 admin.php groups[] sql injection (Advisory 122282 / EDB-26623)
vuldb·2026-05-07·CVSS 7.5
CVE-2013-3727 [HIGH] Kasseler-cms 2 admin.php groups[] sql injection (Advisory 122282 / EDB-26623)
A vulnerability described as problematic has been identified in Kasseler-cms 2. Impacted is an unknown function of the file admin.php. Executing a manipulation of the argument groups[] can lead to sql injection.
This vulnerability is registered as CVE-2013-3727. It is possible to launch the attack remotely. Furthermore, an exploit is available.
Upgrading the affected component is recommended.
GHSA
GHSA-2x7x-45v7-xmvx: Multiple cross-site request forgery (CSRF) vulnerabilities in Kasseler CMS before 2 r1232 allow remote attackers to hijack the authentication of admin
ghsa_unreviewed·2022-05-17·CVSS 7.5
CVE-2013-3729 [HIGH] CWE-352 GHSA-2x7x-45v7-xmvx: Multiple cross-site request forgery (CSRF) vulnerabilities in Kasseler CMS before 2 r1232 allow remote attackers to hijack the authentication of admin
Multiple cross-site request forgery (CSRF) vulnerabilities in Kasseler CMS before 2 r1232 allow remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the (1) groups[] parameter in a send action in the sendmail module or (2) query parameter in a sql_query action in the database module to admin.php, related to CVE-2013-3727.
GHSA
GHSA-g7wx-w9gv-h2x2: SQL injection vulnerability in Kasseler CMS before 2 r1232 allows remote authenticated users to execute arbitrary SQL commands via the groups[] parame
ghsa_unreviewed·2022-05-17
CVE-2013-3727 [HIGH] CWE-89 GHSA-g7wx-w9gv-h2x2: SQL injection vulnerability in Kasseler CMS before 2 r1232 allows remote authenticated users to execute arbitrary SQL commands via the groups[] parame
SQL injection vulnerability in Kasseler CMS before 2 r1232 allows remote authenticated users to execute arbitrary SQL commands via the groups[] parameter to admin.php. NOTE: this can be leveraged using CSRF to allow remote unauthenticated attackers to execute arbitrary SQL commands.
No detection rules found.
No writeups or analysis indexed.
http://diff.kasseler-cms.net/svn.htmlhttp://diff.kasseler-cms.net/svn/patches/1232.htmlhttp://osvdb.org/94779http://packetstormsecurity.com/files/122282/Kasseler-CMS-2-r1223-CSRF-XSS-SQL-Injection.htmlhttp://seclists.org/bugtraq/2013/Jul/26https://exchange.xforce.ibmcloud.com/vulnerabilities/85407https://www.htbridge.com/advisory/HTB23158http://diff.kasseler-cms.net/svn.htmlhttp://diff.kasseler-cms.net/svn/patches/1232.htmlhttp://osvdb.org/94779http://packetstormsecurity.com/files/122282/Kasseler-CMS-2-r1223-CSRF-XSS-SQL-Injection.htmlhttp://seclists.org/bugtraq/2013/Jul/26https://exchange.xforce.ibmcloud.com/vulnerabilities/85407https://www.htbridge.com/advisory/HTB23158
2014-03-13
Published