Description

An issue was discovered in ming-soft MCMS v5.0, where a malicious user can exploit SQL injection without logging in through /mcms/view.do.

Remediation

References

https://github.com/ming-soft/MCMS/issues/45

Related Vulnerabilities

CVE-2023-24187 Vulnerability in maven package com.bstek.ureport:ureport2-core

CVE-2020-19697 Vulnerability in maven package org.webjars.bower:editor.md

CVE-2020-5259 Vulnerability in maven package org.webjars.bowergithub.dojo:dojox

CVE-2021-21266 Vulnerability in maven package org.openhab.addons.bundles:org.openhab.binding.vitotronic

CVE-2021-31805 Vulnerability in maven package org.apache.struts:struts2-core

Severity

Critical

Classification

CWE-89 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Exploit Third Party Advisory