PT-2022-12998
CVE-2022-0153
·
تاريخ النشر
2022-03-24
·
تاريخ التحديث
2022-03-29
الوصف من
CVSS 3.1
9.6
حرجةالمقاييسAV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Name of the Vulnerable Software and Affected Versions
Fork CMS versions prior to 5.11.1
Description
The issue concerns a SQL injection vulnerability. When deleting submissions that belong to a form created with the
FormBuilder module, the parameter id[] is vulnerable to SQL injection.Recommendations
For versions prior to 5.11.1, update to version 5.11.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the
FormBuilder module and avoiding the use of the id[] parameter in affected API endpoints until the issue is resolved. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾