Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1mOTlyLWpqZ3ItZjM3M804wg

SQL injection in ImpressCMS

SQL Injection in ImpressCMS 1.4.3 and earlier allows remote attackers to inject into the code in unintended way, this allows an attacker to read and modify the sensitive information from the database used by the application. If misconfigured, an attacker can even upload a malicious web shell to compromise the entire system.

Permalink: https://github.com/advisories/GHSA-f99r-jjgr-f373
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1mOTlyLWpqZ3ItZjM3M804wg
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: about 2 years ago
Updated: about 1 year ago

CVSS Score: 7.2
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Identifiers: GHSA-f99r-jjgr-f373, CVE-2022-26986
References:

• https://nvd.nist.gov/vuln/detail/CVE-2022-26986
• https://github.com/sartlabs/0days/blob/main/ImpressCMS1.4.3/Exploit.txt
• http://packetstormsecurity.com/files/171485/ImpressCMS-1.4.3-SQL-Injection.html
• https://github.com/advisories/GHSA-f99r-jjgr-f373

Repository: https://github.com/sartlabs/0days
Blast Radius: 1.0

Affected Packages