CVE-2021-44302

Name of the Vulnerable Software and Affected Versions BaiCloud-cms version 2.5.7

Description The issue concerns multiple SQL injection vulnerabilities. These vulnerabilities can be exploited via the tongji and baidu map parameters in the "/user/ztconfig.php" API endpoint.

Recommendations For BaiCloud-cms version 2.5.7, consider disabling access to the "/user/ztconfig.php" API endpoint until a patch is available. Restrict the use of the tongji and baidu map parameters to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.