PT-2022-10073 · Duxcms · Duxcms

Starl23 · Published 2022-02-16 · Updated 2022-02-24 · CVE-2021-3242

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DuxCMS version 3.1.3

Description A SQL injection issue was found in DuxCMS via the component "s/tools/SendTpl/index?keyword=". This allows for potential SQL injection attacks.

Recommendations For DuxCMS version 3.1.3, consider restricting access to the "s/tools/SendTpl/index?keyword=" component until a patch is available. As a temporary workaround, avoid using the keyword parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-3242

Affected Products

Duxcms

References · 6

• 🔥 https://github.com/duxphp/DuxCMS3/issues/4 · Exploit
• https://osv.dev/vulnerability/CVE-2021-3242 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-3242 · Security Note
• https://star123.top/2021/01/16/duxcms3-1-3%E5%AE%A1%E8%AE%A1 · Note
• https://t.me/cibsecurity/37617 · Telegram Post
• https://t.me/cvenotify/27288 · Telegram Post