Mingsoft MCMS up to 5.2.9 /cms/category/list sqlWhere sql injection

EntryDiffrelatejsonxmlCTI

A vulnerability was found in Mingsoft MCMS up to 5.2.9. It has been classified as critical. Affected is an unknown function of the file /cms/category/list. The manipulation of the argument sqlWhere leads to sql injection. Using CWE to declare the problem leads to CWE-89. The weakness was released 12/09/2022. The advisory is shared for download at gitee.com. This vulnerability is traded as CVE-2022-4375. It is possible to launch the attack remotely. Technical details are available. Furthermore, there is an exploit available. The exploit has been disclosed to the public and may be used. The current price for an exploit might be approx. USD $0-$5k at the moment. The MITRE ATT&CK project declares the attack technique as T1505. It is declared as proof-of-concept. The exploit is shared for download at gitee.com. As 0-day the estimated underground price was around $0-$5k. Upgrading to version 5.2.10 is able to address this issue. It is recommended to upgrade the affected component.

Timeline

The analysis of the timeline helps to identify the required approach and handling of single vulnerabilities and vulnerability collections. This overview makes it possible to see less important slices and more severe hotspots at a glance. Initiating immediate vulnerability response and prioritizing of issues is possible.

User

VulDB Mod Team	66

Field

cvss3_meta_tempscore	2
cvss3_meta_basescore	2
cvss3_cna_basescore	1
cvss3_nvd_basescore	1
cve_cna	1

Commit Conf

90%	37
70%	19
50%	10

Approve Conf

90%	37
70%	19
80%	10

66 Commits

ID	Commited	User	Field	Change	Remarks	Moderation	Response	C
13467315	01/02/2023	VulDB…	cvss3_cna_basescore	6.3	see CVSS documentation	01/02/2023	accepted	90
13467314	01/02/2023	VulDB…	cvss3_nvd_basescore	9.8	nist.gov	01/02/2023	accepted	90
13467313	01/02/2023	VulDB…	cvss3_meta_tempscore	7.3	see CVSS documentation	01/02/2023	accepted	90
13467312	01/02/2023	VulDB…	cvss3_meta_basescore	7.5	see CVSS documentation	01/02/2023	accepted	90
13467311	01/02/2023	VulDB…	cve_cna	VulDB	nvd.nist.gov	01/02/2023	accepted	70
13467310	01/02/2023	VulDB…	cvss3_cna_a	L	nvd.nist.gov	01/02/2023	accepted	70
13467309	01/02/2023	VulDB…	cvss3_cna_i	L	nvd.nist.gov	01/02/2023	accepted	70
13467308	01/02/2023	VulDB…	cvss3_cna_c	L	nvd.nist.gov	01/02/2023	accepted	70
13467307	01/02/2023	VulDB…	cvss3_cna_s	U	nvd.nist.gov	01/02/2023	accepted	70
13467306	01/02/2023	VulDB…	cvss3_cna_ui	N	nvd.nist.gov	01/02/2023	accepted	70
13467305	01/02/2023	VulDB…	cvss3_cna_pr	L	nvd.nist.gov	01/02/2023	accepted	70
13467304	01/02/2023	VulDB…	cvss3_cna_ac	L	nvd.nist.gov	01/02/2023	accepted	70
13467303	01/02/2023	VulDB…	cvss3_cna_av	N	nvd.nist.gov	01/02/2023	accepted	70
13467302	01/02/2023	VulDB…	cvss3_nvd_a	H	nvd.nist.gov	01/02/2023	accepted	70
13467301	01/02/2023	VulDB…	cvss3_nvd_i	H	nvd.nist.gov	01/02/2023	accepted	70
13467300	01/02/2023	VulDB…	cvss3_nvd_c	H	nvd.nist.gov	01/02/2023	accepted	70
13467299	01/02/2023	VulDB…	cvss3_nvd_s	U	nvd.nist.gov	01/02/2023	accepted	70
13467298	01/02/2023	VulDB…	cvss3_nvd_ui	N	nvd.nist.gov	01/02/2023	accepted	70
13467297	01/02/2023	VulDB…	cvss3_nvd_pr	N	nvd.nist.gov	01/02/2023	accepted	70
13467296	01/02/2023	VulDB…	cvss3_nvd_ac	L	nvd.nist.gov	01/02/2023	accepted	70

46 more entries are not shown

🔒 Login Required

You need to signup and login to see more of the remaining 46 results.

◂ Previous Overview Next ▸

Interested in the pricing of exploits?

See the underground prices here!