CVE-2018-17796

2018-09-3020:29:00

Google

osv.dev

7.9 High

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

56.0%

JSON

An issue was discovered in MRCMS (aka mushroom) through 3.1.2. The WebParam.java file directly accepts the FIELD_T parameter in a request and uses it as a hash of SQL statements without filtering, resulting in a SQL injection vulnerability in getChannel() in the ChannelService.java file.

CPENameOperatorVersion
mushroomeq3.1.1
mushroomeq2.0
mushroomeq3.1.2

Name	Operator	Version
mushroom	eq	3.1.1
mushroom	eq	2.0
mushroom	eq	3.1.2

References

github.com/wuweiit/mushroom/issues/16