CSZCMS SQL Injection Vulnerability (CNVD-2023-64217)

2023-08-1500:00:00

China National Vulnerability Database

www.cnvd.org.cn

cszcms

sql injection

web application

vulnerability

validation

pm_sendmail parameter

csz_model.php

attacker

sensitive data

database

8.3 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

31.9%

JSON

CSZCMS is an open source web application that allows to manage all the content and settings on the website. A SQL injection vulnerability exists in CSZCMS version 1.2.9, which stems from a lack of validation of externally entered SQL statements in the pm_sendmail parameter in csz_model.php. An attacker can exploit this vulnerability to execute illegal SQL commands to steal sensitive database data.

CPENameOperatorVersion
cszcms cszcmseq1.2.9

CPE	Name	Operator	Version
	cszcms cszcms	eq	1.2.9