CVE-2019-17612

Name of the Vulnerable Software and Affected Versions 74CMS version 5.2.8

Description An issue was discovered that allows SQL Injection, generated by the list method in the Common/Controller/BackendController.class.php file via the index.php?m=Admin&c=Ad&a=category API endpoint, specifically through the sort parameter.

Recommendations For 74CMS version 5.2.8, consider restricting access to the index.php?m=Admin&c=Ad&a=category API endpoint to minimize the risk of exploitation, and avoid using the sort parameter until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.