CVE-2014-10034

Vulnerability

The vulnerability exists in the admin area of couponPHP versions before 1.2.0. The iDisplayLength and iDisplayStart parameters in /admin/ajax/comments_paginate.php and /admin/ajax/stores_paginate.php are not sanitized before being used in SQL queries, allowing remote attackers with admin access to inject arbitrary SQL commands. [1], [2]

Exploitation

An attacker must have administrative access to the couponPHP backend. The attack involves crafting a GET request to either comments_paginate.php or stores_paginate.php with malicious SQL injected into the iDisplayLength or iDisplayStart parameters. For example, appending a single quote and SQL code to iDisplayLength can trigger the injection. [2]

Impact

Successful exploitation allows an authenticated admin attacker to execute arbitrary SQL commands, potentially leading to disclosure or modification of database contents, including user credentials and sensitive site data. This can result in a full compromise of the application's database. [1], [2]

Mitigation

The vendor released version 1.2.0 to fix this vulnerability. Users should upgrade to couponPHP 1.2.0 or later. No workarounds are documented. The vulnerability is not listed in CISA's KEV. [1], [2]