Unrated severityNVD Advisory· Published Feb 11, 2014· Updated Apr 29, 2026
CVE-2014-1401
CVE-2014-1401
Description
Multiple SQL injection vulnerabilities in AuraCMS 2.3 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) search parameter to mod/content/content.php or (2) CLIENT_IP, (3) X_FORWARDED_FOR, (4) X_FORWARDED, (5) FORWARDED_FOR, or (6) FORWARDED HTTP header to index.php.
Affected products
13cpe:2.3:a:auracms:auracms:*:*:*:*:*:*:*:*+ 12 more
- cpe:2.3:a:auracms:auracms:*:*:*:*:*:*:*:*range: <=2.3
- cpe:2.3:a:auracms:auracms:1.0:*:*:*:*:*:*:*
- cpe:2.3:a:auracms:auracms:1.1:*:*:*:*:*:*:*
- cpe:2.3:a:auracms:auracms:1.2:*:*:*:*:*:*:*
- cpe:2.3:a:auracms:auracms:2.0:*:*:*:*:*:*:*
- cpe:2.3:a:auracms:auracms:2.1:*:*:*:*:*:*:*
- cpe:2.3:a:auracms:auracms:2.2:*:*:*:*:*:*:*
- cpe:2.3:a:auracms:auracms:2.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:auracms:auracms:2.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:auracms:auracms:1.3:*:*:*:*:*:*:*
- cpe:2.3:a:auracms:auracms:1.5:*:*:*:*:*:*:*
- cpe:2.3:a:auracms:auracms:1.61:*:*:*:*:*:*:*
- cpe:2.3:a:auracms:auracms:1.62:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
8- packetstormsecurity.com/files/125079nvd
- secunia.com/advisories/56804nvd
- www.exploit-db.com/exploits/31520nvd
- www.securityfocus.com/archive/1/530930/100/0/threadednvd
- exchange.xforce.ibmcloud.com/vulnerabilities/90965nvd
- github.com/auracms/AuraCMS/commit/4fe9d0d31a32df392f4d6ced8e5c25ed4af19adenvd
- github.com/auracms/AuraCMS/commit/790f66ffbc4f23a6e13636fc79d0aa1a7d81e747nvd
- www.htbridge.com/advisory/HTB23196nvd
News mentions
0No linked articles in our index yet.