GitHub Advisoryadvisory · Packagist

GHSA-rr8m-29g8-8cgc SQL Injection in Fork CMS

HIGH Published 2022-03-26 Modified 2022-04-01 Official page ↗

Aliases: CVE-2022-1064
Ecosystem: Packagist
Packages: forkcms/forkcms
Severity: High
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-89
Reviewed: 2022-03-30

Affected packages

• Packagist forkcms/forkcms: < 5.11.1 → fixed in 5.11.1

Description

Fork CMS is vulnerable to SQL injection through marking blog comments on bulk as spam in versions prior to 5.11.1.

Related

Alias · CVE (1)

CVE-2022-1064 SQL injection through marking blog comments on bulk as spam in GitHub repository forkcms/forkcms prior to 5.11.1. vulnerability

Weakness · CWE (1)

CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References