SQL Injection Vulnerability in Mingsoft MCMS Web Content Management System
CVE-2022-30048

9.8CRITICAL

Key Information:

Vendor

Mingsoft

Status
Mcms
Vendor
CVE Published:
11 May 2022

What is CVE-2022-30048?

Mingsoft MCMS version 5.2.7 has a SQL injection vulnerability that affects the /mdiy/dict/list URI via the orderBy parameter. This flaw allows attackers to execute arbitrary SQL queries, potentially leading to unauthorized data access and manipulation. It's essential for users of this CMS to implement security measures to mitigate the risks associated with this vulnerability.

References

https://gitee.com/mingSoft/MCMS/issues/I54VG0
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.