PT-2023-11748 · Gila Cms · Gila Cms

Published 2023-12-27 · Updated 2024-01-09 · CVE-2020-26625

Positive Technologies (AI Summary)

CVSS v3.1

3.8

Low

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Gila CMS versions 1.15.4 and earlier

Description A SQL injection issue was discovered that allows a remote attacker to execute arbitrary web scripts via the user id parameter after the login portal. This enables the attacker to potentially access or manipulate sensitive data.

Recommendations For Gila CMS versions 1.15.4 and earlier, as a temporary workaround, consider restricting access to the login portal or disabling the use of the user id parameter until a patch is available. Avoid using the user id parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2020-26625

GHSA-3PFJ-G4WR-QJ3J

Affected Products

Gila Cms

References · 11

• 🔥 https://packetstormsecurity.com/files/176301/GilaCMS-1.15.4-SQL-Injection.html · Exploit
• https://github.com/GilaCMS/gila/security/policy · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-26625 · Security Note
• https://osv.dev/vulnerability/GHSA-3pfj-g4wr-qj3j · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-26625 · Vendor Advisory
• https://github.com/GilaCMS/gila · Note
• https://t.me/cibsecurity/74207 · Telegram Post
• https://t.me/cvenotify/66729 · Telegram Post
• http://gilacms.com · Note
• https://twitter.com/CVEnew/status/1742303057814376632 · Twitter Post
• https://twitter.com/RedPacketSec/status/1739950226113265714 · Twitter Post