PT-2021-10475
CVE-2020-20295
·
تاريخ النشر
2021-02-01
·
تاريخ التحديث
2021-02-02
الوصف من
CVSS 3.1
9.8
حرجةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions:
CMSWing version 1.3.8
Description:
An issue was found in the CMSWing project where the
updateAction function does not check the detail parameter, allowing malicious parameters to execute arbitrary SQL commands.Recommendations:
For CMSWing version 1.3.8, consider disabling the
updateAction function until a patch is available to prevent exploitation. Restrict access to the detail parameter in the affected function to minimize the risk of arbitrary SQL command execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.قابلية الاستغلال
استغلال
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾