PT-2022-12718 · Unknown · Victor Cms

Published 2022-01-31 · Updated 2022-02-04 · CVE-2021-46459

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Victor CMS version 1.0

Description The issue concerns SQL injection vulnerabilities found in the admin/users.php component, specifically when the source parameter is set to add user. These vulnerabilities can be exploited through a crafted POST request by manipulating the user name, user firstname, user lastname, or user email parameters.

Recommendations For Victor CMS version 1.0, as a temporary workaround, consider restricting access to the admin/users.php component, specifically the "add user" source, until a patch is available. Avoid using the user name, user firstname, user lastname, or user email parameters in the affected API endpoint until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-46459

Affected Products

Victor Cms

References · 4

• 🔥 https://github.com/Nguyen-Trung-Kien/CVE · Exploit
• 🔥 https://github.com/Nguyen-Trung-Kien/CVE/tree/main/CVE-2021-46459 · Exploit
• https://osv.dev/vulnerability/CVE-2021-46459 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-46459 · Security Note