CVE-2018-17796

CVE-2018-17796 affects MRCMS (aka mushroom) up to version 3.1.2. The WebParam.java file directly accepts the FIELD_T parameter from a request and uses it as a hash of SQL statements without filtering, resulting in a SQL injection vulnerability in ChannelService.getChannel(). This is supported by ...