CVE-2017-11419

Name of the Vulnerable Software and Affected Versions Fiyo CMS version 2.0.7

Description The issue concerns SQL injection. It can be exploited via the /apps/app article/controller/editor.php endpoint using the $ POST['id'] and $ POST['art title'] variables.

Recommendations For Fiyo CMS version 2.0.7, consider restricting access to the /apps/app article/controller/editor.php endpoint until a patch is available. As a temporary workaround, avoid using the $ POST['id'] and $ POST['art title'] variables in this endpoint to minimize the risk of exploitation.