CVE-2020-35597

Опубликовано: 16 июн. 2022

Источник: nvd

CVSS3: 8.8

CVSS2: 6.5

EPSS Низкий

Описание

Victor CMS 1.0 is vulnerable to SQL injection via c_id parameter of admin_edit_comment.php, p_id parameter of admin_edit_post.php, u_id parameter of admin_edit_user.php, and edit parameter of admin_update_categories.php.

Ссылки

https://cxsecurity.com/issue/WLB-2020120118
Exploit
Third Party Advisory
https://github.com/VictorAlagwu/CMSsite/issues/16
Issue Tracking
Third Party Advisory
https://www.exploit-db.com/exploits/49282
Exploit
Third Party Advisory
VDB Entry
https://cxsecurity.com/issue/WLB-2020120118
Exploit
Third Party Advisory
https://github.com/VictorAlagwu/CMSsite/issues/16
Issue Tracking
Third Party Advisory
https://www.exploit-db.com/exploits/49282
Exploit
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:victor_cms_project:victor_cms:1.0:*:*:*:*:*:*:*

EPSS

Процентиль: 76%

0.00946

Низкий

8.8 High

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-89

Связанные уязвимости

GHSA-vrcv-w2wx-vq9w