title: WS_FTP Server SQL Injection via Administrative Interface
description:
In WS_FTP Server versions prior to 8.7.4 and 8.8.2,
a SQL injection vulnerability exists in the WS_FTP Server manager interface. An attacker may be able to infer information about the structure and contents of the database and execute SQL statements that alter or delete database elements.
problem types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
affected:
{
defaultStatus: affected
modules: Server Manager
product: WS_FTP Server
vendor: Progress Software Corporation
versions:
lessThan: 8.8.2, status: affected, version: 8.8.0, versionType: semver
lessThan: 8.7.4, status: affected, version: 8.7.0, versionType: semver
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L
version: 3.1
]
format: CVSS
scenarios: GENERAL