SQL Injection Vulnerability in HumHub Product by HumHub Inc.
CVE-2014-9528
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2014-9528?
A SQL injection vulnerability exists in the actionIndex function of the ListController in HumHub, allowing remote authenticated users to input malicious SQL commands through the 'from' parameter of index.php. This flaw not only permits unauthorized database access but may also be exploited to facilitate cross-site scripting (XSS) attacks if an error response is generated, increasing the risk of user data compromise.
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.