{"api_version":"1","generated_at":"2026-07-23T13:11:23+00:00","cve":"CVE-2014-10034","urls":{"html":"https://cve.report/CVE-2014-10034","api":"https://cve.report/api/cve/CVE-2014-10034.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2014-10034","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2014-10034"},"summary":{"title":"CVE-2014-10034","description":"Multiple SQL injection vulnerabilities in the admin area in couponPHP before 1.2.0 allow remote administrators to execute arbitrary SQL commands via the (1) iDisplayLength or (2) iDisplayStart parameter to (a) comments_paginate.php or (b) stores_paginate.php in admin/ajax/.","state":"PUBLISHED","assigner":"mitre","published_at":"2015-01-13 15:59:43","updated_at":"2026-05-06 22:30:45"},"problem_types":["CWE-89","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"6.5","severity":"","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://osvdb.org/show/osvdb/103896","name":"http://osvdb.org/show/osvdb/103896","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/91550","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/91550","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://osvdb.org/show/osvdb/103895","name":"http://osvdb.org/show/osvdb/103895","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://couponphp.com/changelog","name":"http://couponphp.com/changelog","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"PHP Coupon Script and Deal Software | couponPHP","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5170.php","name":"http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5170.php","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"Zero Science Lab » couponPHP CMS 1.0 Multiple Stored XSS and SQL Injection Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.exploit-db.com/exploits/32037","name":"http://www.exploit-db.com/exploits/32037","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"couponPHP CMS 1.0 - Multiple Stored XSS and SQL Injection Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://packetstormsecurity.com/files/125480","name":"http://packetstormsecurity.com/files/125480","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"couponPHP CMS 1.0 Cross Site Scripting / SQL Injection ≈ Packet Storm","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-10034","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-10034","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2014","cve_id":"10034","vulnerable":"1","versionEndIncluding":"1.1.0","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"couponphp","cpe5":"couponphp","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T14:02:38.178Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"103895","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://osvdb.org/show/osvdb/103895"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://couponphp.com/changelog"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5170.php"},{"name":"couponphp-commentspaginate-sql-injection(91550)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/91550"},{"name":"32037","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"],"url":"http://www.exploit-db.com/exploits/32037"},{"name":"103896","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://osvdb.org/show/osvdb/103896"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://packetstormsecurity.com/files/125480"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2014-02-28T00:00:00.000Z","descriptions":[{"lang":"en","value":"Multiple SQL injection vulnerabilities in the admin area in couponPHP before 1.2.0 allow remote administrators to execute arbitrary SQL commands via the (1) iDisplayLength or (2) iDisplayStart parameter to (a) comments_paginate.php or (b) stores_paginate.php in admin/ajax/."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-09-07T15:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"103895","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://osvdb.org/show/osvdb/103895"},{"tags":["x_refsource_CONFIRM"],"url":"http://couponphp.com/changelog"},{"tags":["x_refsource_MISC"],"url":"http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5170.php"},{"name":"couponphp-commentspaginate-sql-injection(91550)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/91550"},{"name":"32037","tags":["exploit","x_refsource_EXPLOIT-DB"],"url":"http://www.exploit-db.com/exploits/32037"},{"name":"103896","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://osvdb.org/show/osvdb/103896"},{"tags":["x_refsource_MISC"],"url":"http://packetstormsecurity.com/files/125480"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2014-10034","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple SQL injection vulnerabilities in the admin area in couponPHP before 1.2.0 allow remote administrators to execute arbitrary SQL commands via the (1) iDisplayLength or (2) iDisplayStart parameter to (a) comments_paginate.php or (b) stores_paginate.php in admin/ajax/."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"103895","refsource":"OSVDB","url":"http://osvdb.org/show/osvdb/103895"},{"name":"http://couponphp.com/changelog","refsource":"CONFIRM","url":"http://couponphp.com/changelog"},{"name":"http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5170.php","refsource":"MISC","url":"http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5170.php"},{"name":"couponphp-commentspaginate-sql-injection(91550)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/91550"},{"name":"32037","refsource":"EXPLOIT-DB","url":"http://www.exploit-db.com/exploits/32037"},{"name":"103896","refsource":"OSVDB","url":"http://osvdb.org/show/osvdb/103896"},{"name":"http://packetstormsecurity.com/files/125480","refsource":"MISC","url":"http://packetstormsecurity.com/files/125480"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2014-10034","datePublished":"2015-01-13T15:00:00.000Z","dateReserved":"2015-01-13T00:00:00.000Z","dateUpdated":"2024-08-06T14:02:38.178Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2015-01-13 15:59:43","lastModifiedDate":"2026-05-06 22:30:45","problem_types":["CWE-89","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:couponphp:couponphp:*:*:*:*:*:*:*:*","versionEndIncluding":"1.1.0","matchCriteriaId":"A89C6E57-AA0E-454E-9EF9-46D589B723EF"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2014","CveId":"10034","Ordinal":"1","Title":"CVE-2014-10034","CVE":"CVE-2014-10034","Year":"2014"},"notes":[{"CveYear":"2014","CveId":"10034","Ordinal":"1","NoteData":"Multiple SQL injection vulnerabilities in the admin area in couponPHP before 1.2.0 allow remote administrators to execute arbitrary SQL commands via the (1) iDisplayLength or (2) iDisplayStart parameter to (a) comments_paginate.php or (b) stores_paginate.php in admin/ajax/.","Type":"Description","Title":"CVE-2014-10034"},{"CveYear":"2014","CveId":"10034","Ordinal":"2","NoteData":"2015-01-13","Type":"Other","Title":"Published"},{"CveYear":"2014","CveId":"10034","Ordinal":"3","NoteData":"2017-09-07","Type":"Other","Title":"Modified"}]}}}