Описание
Grocery Crud 1.6.4 contains a SQL injection vulnerability in the order_by parameter that allows remote attackers to manipulate database queries. Attackers can inject malicious SQL code through the order_by[] parameter in POST requests to the ajax_list endpoint to potentially extract or modify database information.
Уязвимые конфигурации
Конфигурация 1Версия до 2.0.1 (исключая)
cpe:2.3:a:grocerycrud:grocery_crud:*:*:*:*:*:*:*:*
EPSS
Процентиль: 14%
0.00045
Низкий
9.1 Critical
CVSS3
Дефекты
CWE-89
Связанные уязвимости
CVSS3: 8.2
github
23 дня назад
Grocery Crud 1.6.4 contains a SQL injection vulnerability in the order_by parameter that allows remote attackers to manipulate database queries. Attackers can inject malicious SQL code through the order_by[] parameter in POST requests to the ajax_list endpoint to potentially extract or modify database information.
EPSS
Процентиль: 14%
0.00045
Низкий
9.1 Critical
CVSS3
Дефекты
CWE-89