Description
A vulnerability has been found in FastCMS up to 0.1.5 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /api/client/article/list. The manipulation of the argument orderBy leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | FastCMS | 0.1.0, 0.1.1, 0.1.2, 0.1.3, 0.1.4, 0.1.5 | — |
References
- VDB-300577 | FastCMS list sql injection vdb-entry technical-description
- VDB-300577 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- Submit #517926 | fastcms v0.1.5 SQL injection vulnerability third-party-advisory
- https://github.com/IceFoxH/VULN/issues/9 issue-tracking
- https://github.com/IceFoxH/VULN/issues/8 exploit issue-tracking