Lucene search

GitHub Advisory DatabaseGHSA-Q863-CCHM-C6C6

HistoryMar 25, 2022 - 12:00 a.m.

SQL Injection in Fork CMS

2022-03-2500:00:33

CWE-89

GitHub Advisory Database

github.com

fork cms

sql injection

vulnerability

formbuilder

submissions

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

30.3%

JSON

Fork CMS contains a SQL injection vulnerability in versions prior to version 5.11.1. When deleting submissions which belong to a formular (made with module FormBuilder), the parameter id[] is vulnerable to SQL injection.

Affected configurations

Vulners

Node

forkcmsforkcmsRange<5.11.1

VendorProductVersionCPE
forkcmsforkcms*cpe:2.3:a:forkcms:forkcms:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
forkcms	forkcms	*	cpe:2.3:a:forkcms:forkcms::::::::

References

github.com/advisories/GHSA-q863-cchm-c6c6

github.com/forkcms/forkcms/commit/7a12046a67ae5d8cf04face3ee75e55f03a1a608

huntr.dev/bounties/841503dd-311c-470a-a8ec-d4579b3274eb

nvd.nist.gov/vuln/detail/CVE-2022-0153

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

30.3%

JSON

Related for GHSA-Q863-CCHM-C6C6