CVE-2021-37478

2021-07-2617:18:39

mitre

www.cve.org

navigatecms

sql injection

parameter manipulation

arbitrary execution

database vulnerability

AI Score

9.8

Confidence

High

EPSS

0.003

Percentile

69.0%

JSON

In NavigateCMS version 2.9.4 and below, function block is vulnerable to sql injection on parameter block-order, which results in arbitrary sql query execution in the backend database.

References

gist.github.com/victomteng1997/ed429fed7de46651c89f05e7591fd4fe

github.com/NavigateCMS/Navigate-CMS

github.com/NavigateCMS/Navigate-CMS/issues/26