PT-2022-23872 · Jfinalcms · Jfinalcms

Jw5T · Published 2022-09-19 · Updated 2022-09-21 · CVE-2022-37203

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions JFinal CMS version 5.1.0

Description The issue is related to SQL Injection. It is mentioned that certain interfaces in JFinal CMS do not utilize the same component or filters but instead use their own SQL concatenation methods, which results in SQL injection.

Recommendations For JFinal CMS version 5.1.0, consider disabling or restricting the use of SQL concatenation methods in affected interfaces until a patch is available. Restrict access to sensitive data to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2022-37203

Affected Products

Jfinalcms

References · 5

• 🔥 https://github.com/AgainstTheLight/someEXP_of_jfinal_cms/blob/main/jfinal_cms/sql3.md · Exploit
• 🔥 https://github.com/AgainstTheLight/CVE-2022-37203/blob/main/README.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-37203 · Security Note
• https://osv.dev/vulnerability/CVE-2022-37203 · Vendor Advisory
• https://t.me/cibsecurity/50067 · Telegram Post