| शीर्षक | foxcms <=1.2.6 SQL Injection |
|---|
| विवरण | The backend provides the ability to execute commands, directly receiving SQL statements submitted by users and calling Db::query() / Db::execute() to execute them. The code only intercepts DROP through string inclusion checks, but does not restrict high-risk statements like UPDATE/INSERT/DELETE/ALTER/CREATE/TRUNCATE/RENAME, nor does it implement parameterization, syntax whitelisting, or read-only mode restrictions. ... |
|---|
| स्रोत | ⚠️ https://github.com/WAz1nR9/CVE/blob/main/FoxCMS_SQL |
|---|
| उपयोगकर्ता | WAz1nR9 (UID 96839) |
|---|
| सबमिशन | 27/03/2026 04:47 AM (6 महीनों पहले) |
|---|
| संयम | 19/04/2026 07:13 AM (23 days later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 307443 [FoxCMS 1.2.5 DataBackup.php executeCommand SQL इंजेक्शन] |
|---|
| अंक | 0 |
|---|