GitHub Advisoryadvisory · Packagist

GHSA-f99r-jjgr-f373 SQL injection in ImpressCMS

HIGH Published 2022-04-06 Modified 2022-04-18 Official page ↗
Aliases
CVE-2022-26986
Ecosystem
Packagist
Packages
impresscms/impresscms
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-89
Reviewed
2022-04-07

Affected packages

• Packagist impresscms/impresscms: <= 1.4.3 (no fix yet)

Description

SQL Injection in ImpressCMS 1.4.3 and earlier allows remote attackers to inject into the code in unintended way, this allows an attacker to read and modify the sensitive information from the database used by the application. If misconfigured, an attacker can even upload a malicious web shell to compromise the entire system.

Related

Alias · CVE (1)

  • CVE-2022-26986 SQL Injection in ImpressCMS 1.4.3 and earlier allows remote attackers to inject into the code in unintended way, this allows an attacker to… vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References