Maoqingyao

A SQL injection issue was discovered in TuziCMS via the component AppManageControllerZhuantiController.class.php.

Name of the Vulnerable Software and Affected Versions: TuziCMS version 2.0.6 Description: A SQL Injection issue exists in the GuestbookController.class.php file, located in AppManageController. This issue may allow unauthorized access to database information. Recommendations: For TuziCMS version 2.0.6, consider restricting access to the GuestbookController.class.php file until a patch is available. As a temporary workaround, review and modify the SQL queries in the GuestbookController.class.php file to prevent injection attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: TuziCMS version 2.0.6 Description: A SQL Injection issue exists via the `id` parameter in `AppManageControllerAdvertController.class.php`. This allows for potential exploitation. Recommendations: For TuziCMS version 2.0.6, consider restricting access to the `id` parameter in the `AdvertController.class.php` file until a patch is available. As a temporary workaround, avoid using the `id` parameter in the affected controller to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue concerns SQL injection in TuziCMS. Specifically, it affects the `index.php/Mobile/Zhuanti/group?id=` endpoint, where the `id` parameter is vulnerable to SQL injection attacks. This could potentially allow attackers to manipulate database queries.

The issue concerns SQL injection in TuziCMS. Specifically, it affects the AppHomeControllerZhuantiController.class.php file. The SQL injection vulnerability is exploitable via the "index.php/Zhuanti/group?id=" substring, which suggests it can be triggered by manipulating the `id` parameter in a specific API endpoint, namely "index.php/Zhuanti/group?id=".