CVE-2021-26599

ImpressCMS before 1.4.3 allows include/findusers.php groups SQL Injection...

ImpressCMS: Incorrect Authorization Checks in /include/findusers.php

Summary: The vulnerability is located in the /include/findusers.php script: 16. include "../mainfile.php"; 17. xoopsheaderfalse; 18. 19. $denied = true; 20. if !empty$REQUEST'token' 21. if icms::$security-validateToken$REQUEST'token', false 22. $denied = false; 23. 24. elseif isobjecticms::$user ...