PT-2022-8881 · Cscms · Cscms

Longlonglongname · Published 2022-01-11 · Updated 2022-01-14 · CVE-2020-28102

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions cscms version 4.1

Description The issue allows for SQL injection via the js del function. This enables potential attackers to inject malicious SQL code, which could lead to unauthorized access or manipulation of database content.

Recommendations For cscms version 4.1, consider disabling the js del function as a temporary workaround until a patch is available. Restrict access to sensitive database operations to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2020-28102

Affected Products

Cscms

References · 4

• 🔥 https://github.com/chshcms/cscms/issues/9 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-28102 · Security Note
• https://osv.dev/vulnerability/CVE-2020-28102 · Vendor Advisory
• https://t.me/cibsecurity/35245 · Telegram Post