CVE-2024-50584

An authenticated attacker with the user/role "Poweruser" can perform an SQL injection by accessing the /class/templateio.php file and supplying malicious GET parameters. The "templates" parameter is vulnerable against blind boolean-based SQL injection attacks. SQL syntax must be injected into the...

CVE-2024-50584

Concrete details found: CVE-2024-50584 involves an authenticated Poweruser who can exploit a SQL injection via the /class/template_io.php endpoint, by supplying malicious GET parameters. The vulnerable parameter is templates, susceptible to blind boolean-based SQL injection with injection of SQL ...