SQL Injection Vulnerability Affects InstantCMS v2.16.2

CVE-2024-31212

What is CVE-2024-31212?

InstantCMS version 2.16.2 contains a SQL injection vulnerability that can be exploited by attackers with administrative privileges. The vulnerability lies within the index_chart_data action where user input is processed without adequate sanitization, allowing for unauthorized SQL code execution. Specifically, the error occurs in the filterFunc function within the core model, which incorporates user input directly into an SQL statement. If the 'period' input is not properly escaped prior to the query formation, it can be manipulated to execute malicious SQL commands, potentially compromising the integrity and security of the database. A patch for this vulnerability has not yet been released.

References