CVE-2024-45265

CVE-2024-45265 建议描述 SkySystem Arfa-CMS 5.1.3132 之前版本的 poll 组件中存在 SQL 注入漏洞，允许远程攻击者通过 psid 参数执行任意 SQL 命令。 漏洞类型 CWE-89 | SQL 注入 产品厂商 SkySystem https://skyss.ru/ 受影响产品代码库 Arfa-CMS - 5.1.3124 及更早版本 权限提升影响 true 供应商是否已确认或承认该漏洞？ true 发现者 Kirill Kalimmulin 参考 https://skyss.ru...

CVE-2024-45264

CVE-2024-45264 推奨される説明 SkySystem Arfa-CMS 5.1.3132以前の管理パネルにおけるクロスサイトリクエストフォージェリ（CSRF）の脆弱性により、リモート攻撃者が新しい管理者を追加し、権限昇格が可能になります。 脆弱性タイプ CWE-352 | クロスサイトリクエストフォージェリ CSRF 製品のベンダー SkySystem https://skyss.ru/ 影響を受ける製品コードベース Arfa-CMS - 5.1.3124 以前 影響 権限昇格 true ベンダーは脆弱性を確認または認識していますか？ true 発見者 Kirill...

CVE-2024-45265

A SQL injection vulnerability in the poll component in SkySystem Arfa-CMS before 5.1.3124 allows remote attackers to execute arbitrary SQL commands via the psid parameter...

CVE-2024-45264

A cross-site request forgery CSRF vulnerability in the admin panel in SkySystem Arfa-CMS before 5.1.3124 allows remote attackers to add a new administrator, leading to escalation of privileges...

CVE-2024-45264

A cross-site request forgery CSRF vulnerability in the admin panel in SkySystem Arfa-CMS before 5.1.3124 allows remote attackers to add a new administrator, leading to escalation of privileges...

CVE-2024-45264

A cross-site request forgery CSRF vulnerability in the admin panel in SkySystem Arfa-CMS before 5.1.3124 allows remote attackers to add a new administrator, leading to escalation of privileges...

CVE-2024-45264

A cross-site request forgery CSRF vulnerability in the admin panel in SkySystem Arfa-CMS before 5.1.3124 allows remote attackers to add a new administrator, leading to escalation of privileges...

CVE-2024-45264

A cross-site request forgery CSRF vulnerability in the admin panel in SkySystem Arfa-CMS before 5.1.3124 allows remote attackers to add a new administrator, leading to escalation of privileges...

SkySystem Arfa-CMS 安全漏洞

SkySystem Arfa-CMS is a content management system from SkySystem, Inc. A security vulnerability exists in SkySystem Arfa-CMS version 5.1.3124 and prior versions, which stems from a cross-site request forgery CSRF vulnerability in the admin panel...

CVE-2024-45265

A SQL injection vulnerability in the poll component in SkySystem Arfa-CMS before 5.1.3124 allows remote attackers to execute arbitrary SQL commands via the psid parameter...

CVE-2024-45265

A SQL injection vulnerability in the poll component in SkySystem Arfa-CMS before 5.1.3124 allows remote attackers to execute arbitrary SQL commands via the psid parameter...

CVE-2024-45265

CVE-2024-45265 affects SkySystem Arfa-CMS before 5.1.3124. The vulnerability is a SQL injection in the poll component, exploitable via the psid parameter to allow remote attackers to execute arbitrary SQL commands. Root cause is improper handling of user-supplied psid data in the poll module, lea...

CVE-2024-45265

A SQL injection vulnerability in the poll component in SkySystem Arfa-CMS before 5.1.3124 allows remote attackers to execute arbitrary SQL commands via the psid parameter...

CVE-2024-45265

A SQL injection vulnerability in the poll component in SkySystem Arfa-CMS before 5.1.3124 allows remote attackers to execute arbitrary SQL commands via the psid parameter...

The vulnerability of the Arfa-CMS content management system, related to the manipulation of cross-site requests, allows a hacker to perform a CSRF attack.

The vulnerability of the Arfa-CMS content management system is related to the manipulation of cross-site requests. Exploiting this vulnerability allows a malicious actor to perform a CSRF attack remotely...

The vulnerability of the Arfa-CMS content management system lies in the lack of measures taken to protect the SQL query structure, allowing for the execution of arbitrary SQL queries.

The vulnerability of the Arfa-CMS content management system is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries remotely...