LAOBANCMS SQL Injection Vulnerability

Laoban CMS LAOBANCMS content management system is based on PHP + MYSQL environment developed by the old class of open-source website building system . LAOBANCMS 2.0 has a SQL injection vulnerability. Attackers can exploit this vulnerability through the admin/login.php guanliyuan parameter for SQL...

CVE-2018-19221

An issue was discovered in LAOBANCMS 2.0. It allows SQL Injection via the admin/login.php guanliyuan parameter...

CVE-2018-19221

CVE-2018-19221 affects LAOBANCMS 2.0. The vulnerability is a SQL injection via the admin/login.php guanliyuan parameter, as described across multiple connected sources. CVSS metrics from the initial document show an overall high/critical impact (CVSS2: 7.5; CVSS3: 9.8) with network access, no aut...

PT-2018-14877

Name of the Vulnerable Software and Affected Versions LAOBANCMS version 2.0 Description An issue was discovered that allows spoofing of the id and guanliyuan cookies in the /admin/login.php API endpoint. Recommendations For LAOBANCMS version 2.0, as a temporary workaround, consider restricting...

PT-2018-14874

Name of the Vulnerable Software and Affected Versions LAOBANCMS version 2.0 Description An issue was discovered that allows SQL Injection via the guanliyuan parameter in the "admin/login.php" endpoint. Recommendations For LAOBANCMS version 2.0, consider restricting access to the guanliyuan...

CVE-2018-19221: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in LAOBANCMS 2.0. It allows SQL Injection via the admin/login.php guanliyuan parameter...

CVE-2018-19224: Reliance on Cookies without Validation and Integrity Checking

An issue was discovered in LAOBANCMS 2.0. /admin/login.php allows spoofing of the id and guanliyuan cookies...