PT-2022-8943 · Unknown · Victor Cms

Frkngkslop · Published 2022-06-16 · Updated 2022-06-27 · CVE-2020-35597

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Victor CMS version 1.0

Description The issue is related to SQL injection. It can be exploited via the c id parameter of "admin edit comment.php", the p id parameter of "admin edit post.php", the u id parameter of "admin edit user.php", and the edit parameter of "admin update categories.php".

Recommendations For Victor CMS version 1.0, consider disabling the admin edit comment.php, admin edit post.php, admin edit user.php, and admin update categories.php scripts until a patch is available to prevent SQL injection attacks. Restrict access to these scripts to minimize the risk of exploitation. Avoid using the c id, p id, u id, and edit parameters in the affected scripts until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2020-35597

Affected Products

Victor Cms

References · 7

• 🔥 https://exploit-db.com/exploits/49282 · Exploit
• 🔥 https://cxsecurity.com/issue/WLB-2020120118 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-35597 · Security Note
• https://osv.dev/vulnerability/CVE-2020-35597 · Vendor Advisory
• https://github.com/VictorAlagwu/CMSsite/issues/16 · Note
• https://t.me/cvenotify/31755 · Telegram Post
• https://t.me/cibsecurity/44667 · Telegram Post