PT-2018-15003
CVE-2018-19558
·
تاريخ النشر
2018-11-26
·
تاريخ التحديث
2018-12-19
الوصف من
CVSS 3.1
9.8
حرجةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
arcms through 2018-03-19
Description
An issue exists in the software due to SQL injection via the
limit parameter in the json/newslist endpoint. This is caused by files ctl/main/Json.php, ctl/main/service/Data.php, and comp/Db/Mysql.php.Recommendations
For arcms through 2018-03-19, as a temporary workaround, consider restricting access to the json/newslist endpoint until a patch is available. Avoid using the
limit parameter in this endpoint to minimize the risk of exploitation. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾