SQL Injection

torfs-ict/cmsms is vulnerable to SQL Injection attacks. The vulnerability exists in the m1sortby parameter in function.adminarticlestab.php due to improperly validated parameters, allowing a remote attacker to inject arbitrary SQL commands...

CVE-2021-28999: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection vulnerability in CMS Made Simple through 2.2.15 allows remote attackers to execute arbitrary commands via the m1sortby parameter to modules/News/function.adminarticlestab.php...

CVE-2021-40961: Improper Neutralization of Special Elements used in an SQL Command

CMS Made Simple =2.2.15 is affected by SQL injection in modules/News/function.adminarticlestab.php. The $sortby variable is concatenated with $query1, but it is possible to inject arbitrary SQL language without using the '...