slackero phpwcms до 1.9.26 $phpwcms['db_prepend'] sql-инъекция

Уязвимость была найдена в slackero phpwcms до 1.9.26. Она была объявлена как критический. Затронута неизвестная функция. Использование CWE для объявления проблемы приводит к тому, что CWE-89. Консультация доступна по адресу github.com. Эта уязвимость обрабатывается как CVE-2021-4301. Атаку можно инициировать удаленно. Имеются технические подробности. Эксплойт отсутствует. Текущая цена за эксплойт может составлять около USD $0-$5k в настоящее время. Этой уязвимости присвоен номер T1505 проектом MITRE ATT&CK. Объявляется Не определено. В 0-дневный период предполагаемая подземная цена составляла около $0-$5k. Обновление до версии 1.9.27 способно решить эту проблему. Обновленную версию можно скачать по адресу github.com. Название патча следующее 77dafb6a8cc1015f0777daeb5792f43beef77a9d. Исправление готово для загрузки по адресу github.com. Рекомендуется обновить затронутый компонент.

Поле28.01.2023 11:3828.01.2023 11:4628.01.2023 11:54
vendorslackeroslackeroslackero
namephpwcmsphpwcmsphpwcms
version<=1.9.26<=1.9.26<=1.9.26
argument$phpwcms['db_prepend']$phpwcms['db_prepend']$phpwcms['db_prepend']
cwe89 (sql-инъекция)89 (sql-инъекция)89 (sql-инъекция)
risk222
cvss3_vuldb_avNNN
cvss3_vuldb_acLLL
cvss3_vuldb_uiNNN
cvss3_vuldb_sUUU
cvss3_vuldb_cLLL
cvss3_vuldb_iLLL
cvss3_vuldb_aLLL
cvss3_vuldb_rlOOO
cvss3_vuldb_rcCCC
identifier77dafb6a8cc1015f0777daeb5792f43beef77a9d77dafb6a8cc1015f0777daeb5792f43beef77a9d77dafb6a8cc1015f0777daeb5792f43beef77a9d
urlhttps://github.com/slackero/phpwcms/commit/77dafb6a8cc1015f0777daeb5792f43beef77a9dhttps://github.com/slackero/phpwcms/commit/77dafb6a8cc1015f0777daeb5792f43beef77a9dhttps://github.com/slackero/phpwcms/commit/77dafb6a8cc1015f0777daeb5792f43beef77a9d
nameОбновлениеОбновлениеОбновление
upgrade_version1.9.271.9.271.9.27
upgrade_urlhttps://github.com/slackero/phpwcms/releases/tag/v1.9.27https://github.com/slackero/phpwcms/releases/tag/v1.9.27https://github.com/slackero/phpwcms/releases/tag/v1.9.27
patch_name77dafb6a8cc1015f0777daeb5792f43beef77a9d77dafb6a8cc1015f0777daeb5792f43beef77a9d77dafb6a8cc1015f0777daeb5792f43beef77a9d
patch_urlhttps://github.com/slackero/phpwcms/commit/77dafb6a8cc1015f0777daeb5792f43beef77a9dhttps://github.com/slackero/phpwcms/commit/77dafb6a8cc1015f0777daeb5792f43beef77a9dhttps://github.com/slackero/phpwcms/commit/77dafb6a8cc1015f0777daeb5792f43beef77a9d
advisoryquotePrevent $phpwcms['db_prepend'] from SQL injectionPrevent $phpwcms['db_prepend'] from SQL injectionPrevent $phpwcms['db_prepend'] from SQL injection
cveCVE-2021-4301CVE-2021-4301CVE-2021-4301
responsibleVulDBVulDBVulDB
date1672786800 (04.01.2023)1672786800 (04.01.2023)1672786800 (04.01.2023)
cvss2_vuldb_avNNN
cvss2_vuldb_acLLL
cvss2_vuldb_ciPPP
cvss2_vuldb_iiPPP
cvss2_vuldb_aiPPP
cvss2_vuldb_rcCCC
cvss2_vuldb_rlOFOFOF
cvss2_vuldb_auSSS
cvss2_vuldb_eNDNDND
cvss3_vuldb_prLLL
cvss3_vuldb_eXXX
cvss2_vuldb_basescore6.56.56.5
cvss2_vuldb_tempscore5.75.75.7
cvss3_vuldb_basescore6.36.36.3
cvss3_vuldb_tempscore6.06.06.0
cvss3_meta_basescore6.37.57.5
cvss3_meta_tempscore6.07.47.4
price_0day$0-$5k$0-$5k$0-$5k
typeContent Management SystemContent Management SystemContent Management System
cve_assigned1672786800 (04.01.2023)1672786800 (04.01.2023)1672786800 (04.01.2023)
cve_nvd_summaryA vulnerability was found in slackero phpwcms up to 1.9.26 and classified as critical. Affected by this issue is some unknown functionality. The manipulation of the argument $phpwcms['db_prepend'] leads to sql injection. The attack may be launched remotely. Upgrading to version 1.9.27 is able to address this issue. The name of the patch is 77dafb6a8cc1015f0777daeb5792f43beef77a9d. It is recommended to upgrade the affected component. VDB-217418 is the identifier assigned to this vulnerability.A vulnerability was found in slackero phpwcms up to 1.9.26 and classified as critical. Affected by this issue is some unknown functionality. The manipulation of the argument $phpwcms['db_prepend'] leads to sql injection. The attack may be launched remotely. Upgrading to version 1.9.27 is able to address this issue. The name of the patch is 77dafb6a8cc1015f0777daeb5792f43beef77a9d. It is recommended to upgrade the affected component. VDB-217418 is the identifier assigned to this vulnerability.A vulnerability was found in slackero phpwcms up to 1.9.26 and classified as critical. Affected by this issue is some unknown functionality. The manipulation of the argument $phpwcms[&#039;db_prepend&#039;] leads to sql injection. The attack may be launched remotely. Upgrading to version 1.9.27 is able to address this issue. The name of the patch is 77dafb6a8cc1015f0777daeb5792f43beef77a9d. It is recommended to upgrade the affected component. VDB-217418 is the identifier assigned to this vulnerability.
cvss3_nvd_avNN
cvss3_nvd_acLL
cvss3_nvd_prNN
cvss3_nvd_uiNN
cvss3_nvd_sUU
cvss3_nvd_cHH
cvss3_nvd_iHH
cvss3_nvd_aHH
cvss2_nvd_avNN
cvss2_nvd_acLL
cvss2_nvd_auSS
cvss2_nvd_ciPP
cvss2_nvd_iiPP
cvss2_nvd_aiPP
cvss3_cna_avNN
cvss3_cna_acLL
cvss3_cna_prLL
cvss3_cna_uiNN
cvss3_cna_sUU
cvss3_cna_cLL
cvss3_cna_iLL
cvss3_cna_aLL
cve_cnaVulDBVulDB
cvss2_nvd_basescore6.56.5
cvss3_nvd_basescore9.89.8
cvss3_cna_basescore6.36.3

◂ ПредыдущийОбзорДалее ▸

Want to stay up to date on a daily basis?

Enable the mail alert feature now!