PT-2018-13459

Name of the Vulnerable Software and Affected Versions phpkaiyuancms PhpOpenSourceCMS POSCMS version 3.2.0 Description The issue allows an unauthenticated user to execute arbitrary SQL commands. This is achieved via the "diy/module/member/controllers/Api.php" file, specifically through the ajax sa...

CVE-2018-16278: Improper Neutralization of Special Elements used in an SQL Command

phpkaiyuancms PhpOpenSourceCMS POSCMS V3.2.0 allows an unauthenticated user to execute arbitrary SQL commands via the diy/module/member/controllers/Api.php ajaxsavedraft function with the dir parameter...