CVE Feed

    Dashboard / CVE / CVE-2014-8682

    CVE-2014-8682

    Multiple SQL injection vulnerabilities in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.6.1105 Beta allow remote attackers to execute arbitrary SQL commands via the q parameter to (1) api/v1/repos/search, which is not properly handled in models/repo.go, or (2) api/v1/users/search, which is not properly handled in models/user.go.

    Published:Nov 21, 2014
    Last Modified:Apr 12, 2025
    EPS:Nov 21, 2014
    EPSS Score:0.64086
    CVSS Score:7.5

    Affected Products

    Vendor
    Gogits
    Product
    Gogs

    Exploits

    http://packetstormsecurity.com/files/129117/Gogs-Repository-Search-SQL-Injection.htmlhttp://seclists.org/fulldisclosure/2014/Nov/33http://www.exploit-db.com/exploits/35238http://www.securityfocus.com/bid/71187https://github.com/gogits/gogs/commit/0c5ba4573aecc9eaed669e9431a70a5d9f184b8dhttp://packetstormsecurity.com/files/129117/Gogs-Repository-Search-SQL-Injection.htmlhttp://seclists.org/fulldisclosure/2014/Nov/33http://www.exploit-db.com/exploits/35238http://www.securityfocus.com/bid/71187https://github.com/gogits/gogs/commit/0c5ba4573aecc9eaed669e9431a70a5d9f184b8dhttps://www.exploit-db.com/exploits/35238https://github.com/nihal1306/gogs

    References

    http://gogs.io/docs/intro/change_log.html
    http://packetstormsecurity.com/files/129117/Gogs-Repository-Search-SQL-Injection.html
    http://seclists.org/fulldisclosure/2014/Nov/33
    http://www.exploit-db.com/exploits/35238
    http://www.securityfocus.com/archive/1/533995/100/0/threaded
    http://www.securityfocus.com/bid/71187
    https://exchange.xforce.ibmcloud.com/vulnerabilities/98694
    https://github.com/gogits/gogs/commit/0c5ba4573aecc9eaed669e9431a70a5d9f184b8d
    http://gogs.io/docs/intro/change_log.html
    http://packetstormsecurity.com/files/129117/Gogs-Repository-Search-SQL-Injection.html
    http://seclists.org/fulldisclosure/2014/Nov/33
    http://www.exploit-db.com/exploits/35238
    http://www.securityfocus.com/archive/1/533995/100/0/threaded
    http://www.securityfocus.com/bid/71187
    https://exchange.xforce.ibmcloud.com/vulnerabilities/98694
    https://github.com/gogits/gogs/commit/0c5ba4573aecc9eaed669e9431a70a5d9f184b8d

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High