CVE-2017-14851

9.8 CRITICAL

A SQL injection vulnerability exists in all Orpak SiteOmat versions prior to 2017-09-25

Published: 2019-06-03 · Last updated: 2026-06-02

Severity and scoring

CVSS: 9.8 CRITICAL
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-89

Affected products

Vendor	Product
orpak	siteomat

Description

A SQL injection vulnerability exists in all Orpak SiteOmat versions prior to 2017-09-25. The vulnerability is in the login page, where the authentication validation process contains an insecure SELECT query. The attack allows for authentication bypass.

Source: NVD

References

[NVD]https://nvd.nist.gov/vuln/detail/CVE-2017-14851
[Other]http://www.securityfocus.com/bid/108167
[Other]https://ics-cert.us-cert.gov/advisories/ICSA-19-122-01
[Vendor advisory]https://www.orpak.com
[Other]http://www.securityfocus.com/bid/108167
[Other]https://ics-cert.us-cert.gov/advisories/ICSA-19-122-01
[Vendor advisory]https://www.orpak.com

Related CVEs

Same vendor

CVE-2017-14854 — A stack buffer overflow exists in one of the Orpak SiteOmat CGI components, allowing for remote code execution (9.1 CRITICAL)
CVE-2017-14853 — The Orpak SiteOmat OrCU component is vulnerable to code injection, for all versions prior to 2017-09-25, due to a search query that uses ... (8.6 HIGH)
CVE-2017-14852 — An insecure communication was found between a user and the Orpak SiteOmat management console for all known versions, due to an invalid SS... (8.6 HIGH)
CVE-2017-14850 — All known versions of the Orpak SiteOmat web management console is vulnerable to multiple instances of Stored Cross-site Scripting due to... (6.1 MEDIUM)
CVE-2017-14728 — An authentication bypass was found in an unknown area of the SiteOmat source code (9.8 CRITICAL)

Same CWE

CVE-2026-53474 — A flaw was found in migration-planner (9.6 CRITICAL)
CVE-2026-52758 — Ghidra before 12.1 contains a SQL injection vulnerability in BSim filter types that concatenate user-supplied values directly into SQL qu... (8.8 HIGH)
CVE-2026-49498 — Ghidra 11.0 before 12.1 contains a SQL injection vulnerability in the changePassword() method of PostgresFunctionDatabase that fails to e... (8.8 HIGH)
CVE-2026-3018 — The Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the ‘wpmlsubscriber_id’ parameter in all versions up t... (7.5 HIGH)
CVE-2026-3326 — The Xstore WordPress theme before 9.7.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX ... (8.6 HIGH)