PT-2022-24240 · Silverstripe · Silverstripe/Framework

Tf1T · Published 2022-11-21 · Updated 2022-11-22 · CVE-2022-38148

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Silverstripe silverstripe/framework versions through 4.11

Description The issue allows SQL Injection, which can be exploited by an attacker with CMS access to execute arbitrary SQL statements. This is achieved by adding an SQL payload in certain parts of the GridField state. The vast majority of Gridfields in Silverstripe CMS are affected.

Recommendations For versions through 4.11, consider restricting access to the GridField state to minimize the risk of exploitation until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2022-38148

GHSA-RR8H-F97Q-8P9C

Affected Products

Silverstripe/Framework

References · 9

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2022-38148.yaml · Exploit
• https://osv.dev/vulnerability/CVE-2022-38148 · Vendor Advisory
• https://silverstripe.org/blog/tag/release · Vendor Advisory
• https://silverstripe.org/download/security-releases/CVE-2022-38148 · Vendor Advisory
• https://forum.silverstripe.org/c/releases · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-38148 · Security Note
• https://osv.dev/vulnerability/GHSA-rr8h-f97q-8p9c · Vendor Advisory
• https://silverstripe.org/download/security-releases · Vendor Advisory
• https://t.me/cibsecurity/53243 · Telegram Post