Lucene search

GitHub Advisory DatabaseGHSA-RPJW-97P8-P2XP

HistoryJan 03, 2024 - 12:30 a.m.

Gila CMS SQL Injection

2024-01-0300:30:22

CWE-89

GitHub Advisory Database

github.com

sql injection

gila cms

administration

widget

remote attacker

arbitrary web scripts

software

3.8 Low

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

8.4 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

50.7%

JSON

SQL Injection vulnerability discovered in Gila CMS 1.15.4 and earlier allows a remote attacker to execute arbitrary web scripts via the Area parameter under the Administration>Widget tab after the login portal.

Affected configurations

Vulners

Node

gilacmsgila_cmsRange≤1.15.4

CPENameOperatorVersion
gilacms/gilale1.15.4

CPE	Name	Operator	Version
	gilacms/gila	le	1.15.4

References

gilacms.com

github.com/advisories/GHSA-rpjw-97p8-p2xp

github.com/GilaCMS/gila

github.com/GilaCMS/gila/security/policy

nvd.nist.gov/vuln/detail/CVE-2020-26623

packetstormsecurity.com/files/176301/GilaCMS-1.15.4-SQL-Injection.html

3.8 Low

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

8.4 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

50.7%

JSON

Related for GHSA-RPJW-97P8-P2XP