CVE-2021-37477

2021-07-2617:17:56

mitre

www.cve.org

navigatecms

sql injection

structure.php

children_order

arbitrary query execution

backend database

AI Score

9.8

Confidence

High

EPSS

0.003

Percentile

69.0%

JSON

In NavigateCMS version 2.9.4 and below, function in structure.php is vulnerable to sql injection on parameter children_order, which results in arbitrary sql query execution in the backend database.

References

gist.github.com/victomteng1997/ed429fed7de46651c89f05e7591fd4fe

github.com/NavigateCMS/Navigate-CMS

github.com/NavigateCMS/Navigate-CMS/issues/26