CVE-2011-4341

🗓️ 12 Feb 2012 22:00:00Reported by redhatType

cve🔗 web.nvd.nist.gov👁 42 Views🌐 WEB

Multiple SQL injection vulnerabilities in Symphony CMS 2.2.3 allow remote authenticated users to execute arbitrary SQL commands via the filter parameter to (1) symphony/publish/comments or (2) symphony/publish/images

Reporter	Title	Published	Views	Family All 5
Circl	CVE-2011-4341	1 Nov 201100:00	–	circl
Cvelist	CVE-2011-4341	12 Feb 201222:00	–	cvelist
EUVD	EUVD-2011-4273	7 Oct 202500:30	–	euvd
NVD	CVE-2011-4341	12 Feb 201222:55	–	nvd
Prion	Sql injection	12 Feb 201222:55	–	prion

NVD

Node

symphony-cms symphony_cmsMatch2.2.3

Source	Link
symphony-cms	www.symphony-cms.com/download/releases/version/2.2.4/
seclists	www.seclists.org/bugtraq/2011/Nov/8
packetstormsecurity	www.packetstormsecurity.org/files/view/106493/symphonycms-sqlxss.txt
secunia	www.secunia.com/advisories/46663
openwall	www.openwall.com/lists/oss-security/2011/11/22/9
github	www.github.com/symphonycms/symphony-2/commit/476e4926e2773588eab10dd3036f27e1411521b5
mavitunasecurity	www.mavitunasecurity.com/xss-and-sql-injection-vulnerabilities-in-symphony-cms/
osvdb	www.osvdb.org/76884
exchange	www.exchange.xforce.ibmcloud.com/vulnerabilities/71105

Parameter	Position	Path	Description	CWE
filter	query param	symphony/publish/comments	SQL injection via filter parameter in publish comments endpoint.	CWE-79
filter	query param	symphony/publish/images	SQL injection via filter parameter in publish images endpoint.	CWE-79

29 Apr 2026 01:13Current

7.1High risk

Vulners AI Score7.1

CVSS 24.3

EPSS0.01989

CWE-79