CVE-2017-11324

Name of the Vulnerable Software and Affected Versions Tilde CMS version 1.0.1

Description An issue was discovered due to missing escaping of the backtick character, making a SELECT query in class.SystemAction.php vulnerable to SQL Injection. The issue can be triggered via a POST request to "/actionphp/action.input.php" with the id parameter.

Recommendations For Tilde CMS version 1.0.1, consider restricting access to the "/actionphp/action.input.php" endpoint until a patch is available, and avoid using the id parameter in this endpoint to minimize the risk of exploitation.