CVE-2018-20508

2022-10-0316:22:05

mitre

www.cve.org

crashfix 1.0.4

sql injection

user[status]

actionindex

usercontroller.php

protected\models\user.php

9.9 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

54.5%

JSON

CrashFix 1.0.4 has SQL Injection via the User[status] parameter. This is related to actionIndex in UserController.php, and the protected\models\User.php search() function.

References

sourceforge.net/p/crashfix/tickets/21/