| शीर्षक | foxcms v1.2.5 SQL Injection |
|---|
| विवरण | A SQL injection vulnerability exists in the batchCope method of the controller located at app/admin/controller/Article.php. Due to improper handling of the ids parameter, user input is directly embedded into a raw SQL query without validation or parameterization. This allows an authenticated attacker to inject arbitrary SQL statements, potentially leading to unauthorized access, extraction of sensitive data, or full compromise of the underlying database. |
|---|
| स्रोत | ⚠️ https://github.com/xiaoyangsec/foxcms_sql_injection/blob/main/foxcms_sql_injection.md |
|---|
| उपयोगकर्ता | xiaoyang (UID 84496) |
|---|
| सबमिशन | 13/05/2025 11:47 AM (1 वर्ष पहले) |
|---|
| संयम | 25/05/2025 12:27 AM (12 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 310243 [qianfox FoxCMS 1.2.5 Article.php batchCope ids SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|