PT-2023-11807 · Cskaza · Csz Cms

Cuhanboy · Published 2023-08-11 · Updated 2023-08-15 · CVE-2020-36136

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions cskaza cszcms version 1.2.9

Description The issue allows attackers to gain sensitive information via the pm sendmail parameter in csz model.php. This is a SQL Injection vulnerability, which can be exploited to obtain sensitive data.

Recommendations For cskaza cszcms version 1.2.9, consider disabling the pm sendmail parameter in csz model.php as a temporary workaround until a patch is available. Restrict access to the csz model.php file to minimize the risk of exploitation. Avoid using the pm sendmail parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2020-36136

Affected Products

Csz Cms

References · 5

• 🔥 https://github.com/cskaza/cszcms/issues/26 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-36136 · Security Note
• https://osv.dev/vulnerability/CVE-2020-36136 · Vendor Advisory
• https://t.me/cibsecurity/68348 · Telegram Post
• https://twitter.com/CVEnew/status/1690264310000304128 · Twitter Post