PT-2019-12350 · Semcms · Semcms

Publicado 2019-04-25 · Atualizado 2019-04-27 · CVE-2019-11518

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SEMCMS version 3.8

Description An issue was discovered in SEMCMS, where the SEMCMS Inquiry.php file allows SQL Injection through the AID[] parameter because the inject check sql protection mechanism in the class.phpmailer.php file is incomplete.

Recommendations For SEMCMS version 3.8, consider disabling the SEMCMS Inquiry.php file or restricting access to it until a patch is available to prevent SQL Injection attacks. Avoid using the AID[] parameter in the affected file until the issue is resolved.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2019-11518

Produtos afetados

Semcms

Referências · 3

• 🔥❌ https://github.com/kikulo/DebugOpen/blob/master/SEMCMS3.8/main.md · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2019-11518 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-11518 · Aviso do Fabricante