CVE-2020-26624

A SQL injection vulnerability was discovered in Gila CMS 1.15.4 and earlier which allows a remote attacker to execute arbitrary web scripts via the ID parameter after the login portal...

CVE-2020-26624

Gila CMS CVE-2020-26624 is a SQL injection affecting version 1.15.4 and earlier. The vulnerability allows a remote attacker to execute arbitrary web scripts through the ID parameter after login. Affected component is the login portal handling the ID parameter; root cause is SQL injection in the b...

GilaCMS 1.15.4 SQL Injection Vulnerability

Description: GilaCMS widget and use wiget area filter to perform search Sample payload: http://targeturl/cm/listrows/widget?page=1&area=dashboard'%20UNION%20ALL%20SELECT%20NULL,NULL,NULL,NULL,@@version,NULL--%20 Attack Vector 2: After login into admin portal, go to edit...

GilaCMS 1.15.4 SQL Injection

Description: GilaCMS widget and use wiget area filter to perform search Sample payload: http://targeturl/cm/listrows/widget?page=1&area=dashboard'%20UNION%20ALL%20SELECT%20NULL,NULL,NULL,NULL,@@version,NULL--%20 Attack Vector 2: After login into admin portal, go to edit...