| Titre | wtcms cms 1.0 SQL Injection |
|---|
| Description | A critical SQL Injection vulnerability has been identified in the delete() function within the SlideController class of the affected application. The vulnerability arises due to improper neutralization of special elements used in an SQL command (ids parameter). The code directly concatenates user-supplied input into an SQL query without using parameterized queries or proper sanitization, allowing an unauthenticated remote attacker to execute arbitrary SQL commands on the underlying database. |
|---|
| La source | ⚠️ https://www.yuque.com/shangu-vvuup/ydpg69/amhlbdhkw0pgt44g?singleDoc# 《SQL Injection Vulnerability in WTCMS 1.0》 |
|---|
| Utilisateur | sT1TcH (UID 91291) |
|---|
| Soumission | 04/11/2025 14:22 (il y a 10 mois) |
|---|
| Modérer | 29/11/2025 13:55 (25 days later) |
|---|
| Statut | Accepté |
|---|
| Entrée VulDB | 333786 [taosir WTCMS SlideController SlideController.class.php delete ids injection SQL] |
|---|
| Points | 20 |
|---|