Description
An SQL injection vulnerability in Symphony CMS before 2.3.2 allows remote authenticated users to execute arbitrary SQL commands via the sort parameter to system/authors/. This vulnerability can also be leveraged using CSRF to allow remote unauthenticated attackers to execute arbitrary SQL commands.
Remediation
Upgrade to the latest version of Symphony.
References
Related Vulnerabilities
Python Out-of-bounds Write Vulnerability (CVE-2018-25032)
Oracle JRE CVE-2020-2655 Vulnerability (CVE-2020-2655)
ATutor Weak Password Recovery Mechanism for Forgotten Password Vulnerability (CVE-2021-43498)
MySQL CVE-2022-21358 Vulnerability (CVE-2022-21358)
Moodle Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2012-0799)