PT-2025-50759 · Csz Cms · Csz Cms

Abdulaziz Almetairy · Published 2025-12-11 · Updated 2025-12-12 · CVE-2024-58307

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions CSZCMS version 1.3.0

Description The software contains an authenticated SQL injection issue in the members view functionality. Authenticated attackers can manipulate database queries by injecting malicious SQL code through the view parameter. This allows for time-based blind SQL injection attacks, potentially leading to the extraction of database information. The affected API endpoint is the members view endpoint.

Recommendations Apply a fix for CSZCMS version 1.3.0 to address the SQL injection issue. As a temporary workaround, restrict access to the members view functionality to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-58307

Affected Products

Csz Cms

References · 9

• 🔥 https://exploit-db.com/exploits/51916 · Exploit
• https://osv.dev/vulnerability/CVE-2024-58307 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-58307 · Security Note
• https://twitter.com/VulmonFeeds/status/1999286181616365632 · Twitter Post
• https://t.me/CVEtracker/39537 · Telegram Post
• https://sourceforge.net/projects/cszcms/files/install/CSZCMS-V1.3.0.zip/download · Note
• https://vulncheck.com/advisories/cszcms-authenticated-sql-injection-via-members-view-endpoint · Note
• https://twitter.com/0dayPublishing/status/1999236620877263137 · Twitter Post
• https://cszcms.com · Note