Mi2Ac1E

**Name of the Vulnerable Software and Affected Versions** ForU CMS versions up to 2020-06-23 **Description** A critical issue has been found in ForU CMS, affecting some unknown functionality of the file cms admin.php. The manipulation of the `a name` argument leads to sql injection. The exploit has been disclosed to the public and may be used. **Recommendations** For ForU CMS versions up to 2020-06-23, consider restricting access to the cms admin.php file to minimize the risk of exploitation. As a temporary workaround, avoid using the `a name` argument in the affected functionality until a patch is available. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** ForU CMS versions up to 2020-06-23 **Description** A critical issue was found in ForU CMS, affecting the file `/admin/index.php?act=reset admin psw`. This issue leads to weak password recovery and can be initiated remotely. **Recommendations** For versions up to 2020-06-23, as a temporary workaround, consider restricting access to the `/admin/index.php?act=reset admin psw` endpoint until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ForU CMS versions up to 2020-06-23 **Description** A critical issue has been found in ForU CMS, affecting the processing of the file admin/cms template.php. The manipulation of the argument `t name`/`t path` leads to sql injection. The attack may be initiated remotely. **Recommendations** For ForU CMS versions up to 2020-06-23, at the moment, there is no information about a newer version that contains a fix for this vulnerability.