CVE-2010-2317 in WmsCms
Summary
by MITRE
Multiple SQL injection vulnerabilities in WmsCms 2.0 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) search, (2) sbr, (3) pid, (4) sbl, and (5) FilePath parameters to default.asp; and the (6) sbr, (7) pr, and (8) psPrice parameters to printpage.asp.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 12/14/2025
The vulnerability identified as CVE-2010-2317 represents a critical security flaw in WmsCms 2.0 and earlier versions, exposing multiple pathways for remote attackers to execute arbitrary SQL commands through carefully crafted input parameters. This vulnerability falls under the category of SQL injection attacks, which occur when an application fails to properly sanitize user input before incorporating it into SQL queries, thereby allowing malicious actors to manipulate database operations. The affected parameters span across two primary files within the application, with default.asp and printpage.asp serving as the primary attack vectors for this particular vulnerability. The specific parameters targeted include search, sbr, pid, sbl, and FilePath in default.asp, while printpage.asp contains vulnerabilities through sbr, pr, and psPrice parameters. These attack vectors demonstrate a classic case of insufficient input validation and parameter sanitization, where user-supplied data directly influences database query construction without proper escaping or encoding mechanisms.
The technical exploitation of these vulnerabilities enables attackers to bypass authentication mechanisms, extract sensitive database information, modify or delete records, and potentially gain unauthorized access to underlying database systems. The impact extends beyond simple data theft as these vulnerabilities can facilitate complete system compromise through database-level attacks. The vulnerability directly maps to CWE-89, which defines SQL injection as the insertion of malicious SQL code into input fields for execution by the database, and aligns with ATT&CK technique T1071.004 for application layer protocol manipulation. When attackers successfully exploit these parameters, they can manipulate the database queries to retrieve administrative credentials, customer data, or other sensitive information stored within the application's backend database. The lack of proper input validation across multiple parameters indicates a systemic security flaw in the application's architecture rather than isolated incidents, suggesting that the entire application requires comprehensive security remediation.
The operational impact of CVE-2010-2317 poses significant risks to organizations utilizing WmsCms 2.0 or earlier versions, as the vulnerabilities can be exploited remotely without requiring authentication or specialized privileges. Attackers can leverage these flaws to perform data exfiltration, modify application behavior, or even establish persistent access through database-level backdoors. The multi-parameter nature of the vulnerability increases the attack surface and reduces the effectiveness of simple input filtering approaches, making comprehensive patching essential for mitigation. Organizations should implement robust input validation, parameterized queries, and proper database access controls to address this vulnerability. The attack vectors identified through this CVE highlight the importance of following secure coding practices and adhering to industry standards such as those outlined in the OWASP Top Ten and NIST guidelines for preventing SQL injection attacks. Security teams must prioritize immediate remediation of this vulnerability through software updates, code reviews, and comprehensive security testing to prevent potential exploitation and maintain the integrity of affected systems.