Murkfox

**Name of the Vulnerable Software and Affected Versions** MingSoft MCMS versions prior to 3.0.7 **Description** A remote SQL injection exists within the `ms-mdiy` component. The issue occurs in the `ModelDataImpl.queryDiyFormData()` function located at the '/mdiy/form/data/list.do' endpoint. An attacker can exploit this by manipulating the `formFields` argument to execute unauthorized SQL commands. **Recommendations** As a temporary workaround, restrict access to the '/mdiy/form/data/list.do' endpoint or avoid using the `formFields` parameter until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MingSoft MCMS versions prior to 3.0.7 **Description** A remote information disclosure issue exists within the `ms-mdiy` component. The flaw is located in an unknown function of the '/mdiy/form/data/list' endpoint, allowing a remote attacker to manipulate the system to disclose sensitive information. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict access to the '/mdiy/form/data/list' endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** MingSoft MCMS versions prior to 3.0.7 **Description** A security flaw in the `ms-mdiy` component allows remote attackers to cause information disclosure. The issue resides within an unknown function of the '/mdiy/form/get' endpoint. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict access to the '/mdiy/form/get' endpoint to minimize the risk of exploitation.