SQL Injection Vulnerability in YzmCMS 3.6 by ATK Security
CVE-2018-7579

7.2HIGH

Key Information:

Vendor
Yzmcms
Status
Yzmcms
Vendor
CVE Published:
1 March 2018

Summary

YzmCMS version 3.6 is susceptible to SQL Injection through improper sanitization of the 'catids' array parameter in the admin/update_urls/update_category_url.html endpoint. This weakness allows attackers to manipulate SQL queries and gain unauthorized access to sensitive information within the database. To mitigate this risk, it is crucial to implement input validation and restrict access to the affected administrative functionalities.

References

http://www.atksec.com/article/yzmcms-v3.6-sqli/index.html
x_refsource_MISC

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.