CVE-2018-17562

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Multi-Tech FaxFinder before 5.1.6 has SQL Injection via a status/call_details?oid= URI, allowing an attacker to extract the underlying database schema to further disclose other fax server information through different injection points.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://securityshards.wordpress.com/2018/10/02/cve-2018-17562-faxfinder-5-0-5-8-sqlite-inejection-vulnerability/Exploit, Third Party Advisory
https://securityshards.wordpress.com/2018/10/02/cve-2018-17562-faxfinder-5-0-5-8-sqlite-inejection-vulnerability/Exploit, Third Party Advisory

Timeline

Published: Oct 3, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-175635.3A Malformed Input String to /cgi-bin/api-get_line_status on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to dump the device's CVE-2018-175649.8A Malformed Input String to /cgi-bin/delete_CA on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to delete configuration paramet CVE-2018-175659.8Shell Metacharacter Injection in the SSH configuration interface on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to execute ar CVE-2018-175669.8In ThinkPHP 5.1.24, the inner function delete can be used for SQL injection when its WHERE condition's value can be controlled by a user's r CVE-2018-175677.5Jekyll through 3.6.2, 3.7.x through 3.7.3, and 3.8.x through 3.8.3 allows attackers to access arbitrary files by specifying a symlink in the CVE-2018-175689.8utils/ut_rpc.c in ViaBTC Exchange Server before 2018-08-21 has an integer overflow leading to memory corruption.CVE-2018-175699.8network/nw_buf.c in ViaBTC Exchange Server before 2018-08-21 has an integer overflow leading to memory corruption.CVE-2018-17575.3IBM Security Identity Governance and Intelligence 5.2.3.2 and 5.2.4 could allow an attacker to obtain sensitive information due to missing a CVE-2018-175709.8utils/ut_ws_svr.c in ViaBTC Exchange Server before 2018-08-21 has an integer overflow leading to memory corruption.CVE-2018-175716.1Vanilla before 2.6.1 allows XSS via the email field of a profile.CVE-2018-175724.8InfluxDB 0.9.5 has Reflected XSS in the Write Data module.CVE-2018-175739.8The Wp-Insert plugin through 2.4.2 for WordPress allows upload of arbitrary PHP code because of the exposure and configuration of FCKeditor