SQL Injection Vulnerability in PbootCMS Admin Controller
CVE-2018-18450

9.8CRITICAL

Key Information:

Vendor

Pbootcms

Status
Pbootcms
Vendor
CVE Published:
17 October 2018

What is CVE-2018-18450?

The PbootCMS application contains a SQL injection vulnerability in the SingleController.php file. This issue arises when improperly sanitized user input is passed to the database via POST requests to the admin.php endpoint. Successful exploitation may allow an attacker to manipulate database queries, potentially leading to unauthorized data access or modification. It is crucial to update to version 1.3.0 build 2018-11-12 or later to mitigate this security risk.

References

https://www.pbootcms.com/changelog.html
x_refsource_CONFIRM
http://www.ttk7.cn/post-96.html
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.