SQL Injection Flaw in MRCMS Product by Mushroom
CVE-2018-17796

9.8CRITICAL

Key Information:

Vendor: Mushroom Content Management System Project
Status: Mushroom Content Management System
Vendor: CVE Published:; 30 September 2018

🔔 Create Mushroom Content Management System Project Vulnerability Alert

What is CVE-2018-17796?

A vulnerability has been identified in MRCMS that allows for SQL injection via the FIELD_T parameter. The WebParam.java file processes this parameter without proper input validation, enabling potential attackers to manipulate SQL queries executed within the getChannel() method of ChannelService.java. This exploitation could allow unauthorized access to sensitive information or compromise the integrity of the database.

References

https://github.com/wuweiit/mushroom/issues/16

x_refsource_MISC

CVSS V3.1

Score:

9.8

Severity:

CRITICAL

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Sep 30, 2018
Vulnerability Reserved
Sep 30, 2018

CVE-2018-17796 Data

JSON