SQL Injection Vulnerability in ImpressCMS by Sartlabs
CVE-2022-26986

7.2HIGH

Key Information:

Vendor

Impresscms

Status
Impresscms
Vendor
CVE Published:
5 April 2022

What is CVE-2022-26986?

ImpressCMS versions 1.4.3 and earlier are susceptible to SQL Injection, which allows remote attackers to manipulate database queries. This vulnerability can lead to unauthorized access to sensitive information, enabling attackers to read and modify data within the database. In scenarios where the application is improperly configured, there is potential for attackers to upload malicious web shells, further compromising the system and escalating the impact of the breach.

References

https://github.com/sartlabs/0days/blob/main/ImpressCMS1.4...
http://packetstormsecurity.com/files/171485/ImpressCMS-1....

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.