PT-2017-11923

Name of the Vulnerable Software and Affected Versions Tilde CMS version 1.0.1 Description An issue was discovered due to missing escaping of the backtick character, making a SELECT query in class.SystemAction.php vulnerable to SQL Injection. The issue can be triggered via a POST request to...

CVE-2017-11324: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in Tilde CMS 1.0.1. Due to missing escaping of the backtick character, a SELECT query in class.SystemAction.php is vulnerable to SQL Injection. The vulnerability can be triggered via a POST request to /actionphp/action.input.php with the id parameter...