PT-2022-18396 · Unknown · Cscms Music Portal System

Am1Azi3Ngo · Published 2022-04-15 · Updated 2022-04-21 · CVE-2022-27366

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cscms Music Portal System version 4.2

Description A blind SQL injection issue was discovered in the Cscms Music Portal System. The vulnerability is located in the dance Dance.php hy component.

Recommendations For Cscms Music Portal System version 4.2, consider restricting access to the dance Dance.php hy component until a patch is available.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2022-27366

Affected Products

Cscms Music Portal System

References · 4

• 🔥 https://github.com/chshcms/cscms/issues/13#issue-1170447891 · Exploit
• https://osv.dev/vulnerability/CVE-2022-27366 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-27366 · Security Note
• https://t.me/cvenotify/29282 · Telegram Post