| शीर्षक | LmxCMS v1.41 SQL Injection |
|---|
| विवरण | A critical SQL injection vulnerability exists in LmxCMS v1.41, located in the manageZt() method within c\admin\ZtAction.class.php. The vulnerability arises because user-supplied sortid parameters are directly concatenated into SQL queries without proper sanitization or parameter binding. This flaw allows attackers to inject arbitrary SQL code, which can lead to sensitive data exposure, privilege escalation, or complete compromise of the database. Exploitation can be achieved by sending a specially crafted POST request, allowing attackers to retrieve sensitive information, manipulate the database, or execute arbitrary SQL commands.
|
|---|
| स्रोत | ⚠️ https://github.com/xiaoyangsec/LmxCMS-SQL-Injection/blob/main/LmxCMS-SQL-Injection.md |
|---|
| उपयोगकर्ता | xiaoyang (UID 84496) |
|---|
| सबमिशन | 29/04/2025 02:23 PM (1 वर्ष पहले) |
|---|
| संयम | 10/05/2025 03:45 PM (11 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 308286 [LmxCMS 1.41 POST Request ZtAction.class.php manageZt sortid SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|