PT-2017-10774
CVE-2017-1000067
·
Published
2017-07-13
·
Updated
2022-05-17
Description by
CVSS 3.1
8.8
HighMetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
MODX Revolution versions 2.x through 2.5.6
Description
The issue is caused by improper sanitization by the escape method, resulting in blind SQL injection. This allows an authenticated user to access the database and possibly escalate privileges.
Recommendations
For MODX Revolution versions 2.x through 2.5.6, update to a version that includes proper sanitization to prevent SQL injection attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Found an issue in the description? Have something to add? Feel free to write us 👾