SQL Injection Vulnerability in REDAXO 5.6.3 and Earlier
CVE-2018-17831

9.8CRITICAL

Key Information:

Vendor: Redaxo
Status: Redaxo
Vendor: CVE Published:; 1 October 2018

What is CVE-2018-17831?

A significant SQL injection vulnerability was identified in the rex_list class of REDAXO prior to version 5.6.3. This flaw arises due to improper handling of the sort parameter in the prepareQuery function located in core/lib/list.php. Both the backend and frontend could be compromised if the rex_list functionality is utilized, making it crucial for users to upgrade to the latest version to mitigate risks.