CVE-2021-43701

Опубликовано: 29 мар. 2022

Источник: nvd

CVSS3: 6.5

CVSS2: 4

EPSS Низкий

Описание

CSZ CMS 1.2.9 has a Time and Boolean-based Blind SQL Injection vulnerability in the endpoint /admin/export/getcsv/article_db, via the fieldS[] and orderby parameters.

Ссылки

http://packetstormsecurity.com/files/166535/CSZ-CMS-1.2.9-SQL-Injection.html
Exploit
Third Party Advisory
VDB Entry
https://github.com/cskaza/cszcms/issues/31
Exploit
Issue Tracking
Third Party Advisory
https://www.exploit-db.com/exploits/50846
Exploit
Third Party Advisory
VDB Entry
http://packetstormsecurity.com/files/166535/CSZ-CMS-1.2.9-SQL-Injection.html
Exploit
Third Party Advisory
VDB Entry
https://github.com/cskaza/cszcms/issues/31
Exploit
Issue Tracking
Third Party Advisory
https://www.exploit-db.com/exploits/50846
Exploit
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:cszcms:csz_cms:1.2.9:*:*:*:*:*:*:*

EPSS

Процентиль: 30%

0.00109

Низкий

6.5 Medium

CVSS3

4 Medium

CVSS2

Дефекты

CWE-89

Связанные уязвимости

GHSA-cmvc-pmvw-gjx4