PT-2023-10811 · Polterguy · Phosphorus Five

Polterguy

·

CVE-2018-25070

·

Published

2023-01-07

·

Updated

2024-05-17

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions polterguy Phosphorus Five versions up to 8.2
Description A critical issue has been found that affects the csv.Read function of the CSV Import component, specifically in the file plugins/extras/p5.mysql/NonQuery.cs. This issue leads to sql injection.
Recommendations For versions up to 8.2, upgrade to version 8.3 to address this issue. As a temporary workaround, consider restricting the use of the csv.Read function in the CSV Import component until the upgrade is applied.

Fix

SQL injection

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2018-25070

Affected Products

Phosphorus Five