Description
Purei CMS 1.0 contains a time-based blind SQL injection vulnerability that allows attackers to manipulate database queries through unfiltered user input parameters. Attackers can exploit vulnerable endpoints like getAllParks.php and events-ajax.php by injecting crafted SQL payloads to potentially extract or modify database information.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| purei | Purei CMS | 1.0 | — |
References
- ExploitDB-51929 exploit
- Purei Homepage product
- VulnCheck Advisory: Purei CMS 1.0 SQL Injection via Multiple Vulnerable Endpoints third-party-advisory