CVE-2021-37476

2021-07-2617:16:55

mitre

www.cve.org

navigatecms

sql injection

post request

AI Score

9.8

Confidence

High

EPSS

0.003

Percentile

69.0%

JSON

In NavigateCMS version 2.9.4 and below, function in product.php is vulnerable to sql injection on parameter id through a post request, which results in arbitrary sql query execution in the backend database.

References

gist.github.com/victomteng1997/ed429fed7de46651c89f05e7591fd4fe

github.com/NavigateCMS/Navigate-CMS

github.com/NavigateCMS/Navigate-CMS/issues/26