GitHub Advisoryadvisory · Packagist

GHSA-rpjw-97p8-p2xp Gila CMS SQL Injection

MEDIUM Published 2024-01-03 Modified 2024-01-03 Official page ↗
Aliases
CVE-2020-26623
Ecosystem
Packagist
Packages
gilacms/gila
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-89
Reviewed
2024-01-03

Affected packages

• Packagist gilacms/gila: <= 1.15.4 (no fix yet)

Description

SQL Injection vulnerability discovered in Gila CMS 1.15.4 and earlier allows a remote attacker to execute arbitrary web scripts via the Area parameter under the Administration>Widget tab after the login portal.

Related

Alias · CVE (1)

  • CVE-2020-26623 SQL Injection vulnerability discovered in Gila CMS 1.15.4 and earlier allows a remote attacker to execute arbitrary web scripts via the… vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References