PT-2017-13572
CVE-2017-14600
·
Published
2017-09-19
·
Updated
2017-09-22
Description by
CVSS 3.1
4.9
MediumMetricsAV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions
Pragyan CMS version 3.0
Description
The issue concerns an Error-Based SQL injection, which can lead to Information Disclosure. This occurs in the cms/admin.lib.php file via the
del black variable in the $ GET request.Recommendations
For Pragyan CMS version 3.0, consider restricting access to the cms/admin.lib.php file until a patch is available. As a temporary workaround, avoid using the
del black variable in the $ GET request to minimize the risk of exploitation.Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾