GitHub Advisoryadvisory · Packagist

GHSA-q863-cchm-c6c6 SQL Injection in Fork CMS

HIGH Published 2022-03-25 Modified 2022-03-30 Official page ↗
Aliases
CVE-2022-0153
Ecosystem
Packagist
Packages
forkcms/forkcms
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-89
Reviewed
2022-03-29

Affected packages

• Packagist forkcms/forkcms: < 5.11.1 → fixed in 5.11.1

Description

Fork CMS contains a SQL injection vulnerability in versions prior to version 5.11.1. When deleting submissions which belong to a formular (made with module `FormBuilder`), the parameter `id[]` is vulnerable to SQL injection.

Related

Alias · CVE (1)

  • CVE-2022-0153 SQL Injection in GitHub repository forkcms/forkcms prior to 5.11.1. vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References