CVE-2018-25431

No-Cms 1.0 SQL Injection via order_by Parameter

CVSS 7.1 HIGHEPSS 0.3%CWE-89

No-Cms 1.0 contains an SQL injection vulnerability in the order_by parameter of the manage_privilege export endpoint that allows authenticated attackers to manipulate database queries. Attackers can submit POST requests to /nocms/main/manage_privilege/index/export with malicious SQL code in the order_by[0] parameter to extract sensitive database information.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Affected products

goFrendiAsgard · No-CMS

public PoCs found — 1

cve_referencewww.exploit-db.com/exploits/45903unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://codeload.github.com/goFrendiAsgard/No-CMS/zip/master https://github.com/goFrendiAsgard/No-CMS https://www.exploit-db.com/exploits/45903 https://www.vulncheck.com/advisories/no-cms-sql-injection-via-order-by-parameter