SQL Injection Vulnerability in WUZHI CMS by WUZHI
CVE-2018-14472

7.2HIGH

Key Information:

Vendor

Wuzhicms

Status
Wuzhicms
Vendor
CVE Published:
20 July 2018

What is CVE-2018-14472?

A significant SQL injection vulnerability exists in WUZHI CMS version 4.1.0, specifically within the file coreframe/app/order/admin/goods.php. This issue arises because the $keywords parameter is processed without adequate sanitization, allowing malicious users to execute arbitrary SQL commands. This security flaw potentially enables attackers to manipulate the database and gain unauthorized access to sensitive information. Organizations using the affected version are strongly advised to implement immediate measures to secure their applications and prevent exploitation.

References

https://github.com/wuzhicms/wuzhicms/issues/144
x_refsource_MISC

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability Reserved

  • Vulnerability published

.