Description

A vulnerability was found in Mingsoft MCMS up to 5.2.9. It has been classified as critical. Affected is an unknown function of the file /cms/category/list. The manipulation of the argument sqlWhere leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 5.2.10 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-215196.

Remediation

References

https://vuldb.com/?id.215196

https://gitee.com/mingSoft/MCMS/issues/I61TG5

Related Vulnerabilities

CVE-2023-35167 Vulnerability in npm package remult

CVE-2023-28155 Vulnerability in maven package org.webjars.bower:request

CVE-2018-8108 Vulnerability in npm package bui

CVE-2021-21266 Vulnerability in maven package org.openhab.addons.bundles:org.openhab.binding.avmfritz

CVE-2022-24376 Vulnerability in npm package git-promise

Severity

Critical

Classification

CWE-89 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Exploit Third Party Advisory VDB Entry Issue Tracking