CVE-2018-25176

Name of the Vulnerable Software and Affected Versions Alive Parish version 2.0.4

Description The software contains an SQL injection issue that permits unauthenticated attackers to execute arbitrary SQL queries. This is achieved by injecting malicious code through the key parameter in the ''/search'' endpoint. Additionally, attackers can upload arbitrary files through the person photo upload functionality to the ''images/uploaded'' directory, potentially leading to remote code execution.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the ''/search'' endpoint. As a temporary workaround, disable the person photo upload functionality.