VULNERABILITY INTELLIGENCE

CVE-2018-16659

CVSS score9.8 CRITICAL
EPSS probability2.74%
CISA KEVNot currently listed
Published2018-09-28
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

An issue was discovered in Rausoft ID.prove 2.95. The login page allows SQL injection via Microsoft SQL Server stacked queries in the Username POST parameter. Hypothetically, an attacker can utilize master..xp_cmdshell for the further privilege elevation.

Weakness classification

  • nvd@nist.gov: CWE-89

Primary references