Description

core/model/MySQLDatabase.php in SilverStripe 2.4.x before 2.4.4, when the site is running in "live mode," allows remote attackers to obtain the SQL queries for a page via the showqueries and ajax parameters.

Remediation

References

CVE-2010-4822

Related Vulnerabilities

Envoy Proxy Loop with Unreachable Exit Condition ('Infinite Loop') Vulnerability (CVE-2019-18836)

WordPress Plugin Testimonial Multiple Vulnerabilities (2.2)

Oracle HTTP Server Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2007-5000)

WordPress Plugin Personalized WooCommerce Cart Page Cross-Site Request Forgery (2.4)

OpenSSL Resource Management Errors Vulnerability (CVE-2015-1788)

Severity

Medium

Classification

CVE-2010-4822 CWE-200

Tags

Missing Update Known Vulnerabilities