Back to CVE Browser

CVE-2016-2351

CRITICAL

9.8

CVSS Severity Score

EPSS Score0.1090%

EPSS Percentile37.64th

PublishedMay 7, 2016

Last ModifiedMay 6, 2026

Vulnerability Description

SQL injection vulnerability in home/seos/courier/security_key2.api on the Accellion File Transfer Appliance (FTA) before FTA_9_12_40 allows remote attackers to execute arbitrary SQL commands via the client_id parameter.

Affected Platforms (CPE)

📦

Accellion

File Transfer Appliance

<= 9_11_210

References & Advisories

🔗 http://devco.re/blog/2016/04/21/how-I-hacked-facebook-and-found-someones-backdoor-script-eng-ver/

🔗 http://www.kb.cert.org/vuls/id/505560

🔗 http://devco.re/blog/2016/04/21/how-I-hacked-facebook-and-found-someones-backdoor-script-eng-ver/

🔗 http://www.kb.cert.org/vuls/id/505560

Related Vulnerabilities

CVE-2015-28579.8

Accellion File Transfer Appliance before FTA_9_11_210 allows remote attackers to execute arbitrary code via shell metacharacters i...

CVE-2019-56239.8

Accellion File Transfer Appliance version FTA_8_0_540 suffers from an instance of CWE-77: Improper Neutralization of Special Eleme...

CVE-2019-56229.8

Accellion File Transfer Appliance version FTA_8_0_540 suffers from an instance of CWE-798: Use of Hard-coded Credentials.

CVE-2009-46449.0

Accellion Secure File Transfer Appliance before 8_0_105 allows remote authenticated administrators to bypass the restricted shell ...