CVE-2018-17831

In REDAXO before 5.6.3, a critical SQL injection vulnerability has been discovered in the rexlist class because of the prepareQuery function in core/lib/list.php, via the index.php?page=users/users sort parameter. Endangered was the backend and the frontend only if rexlist were used...

PT-2018-14211

Name of the Vulnerable Software and Affected Versions REDAXO versions prior to 5.6.3 Description A critical SQL injection issue has been found in the rex list class due to the prepareQuery function in core/lib/list.php. This can be exploited via the "sort" parameter in the...

CVE-2018-17831: Improper Neutralization of Special Elements used in an SQL Command

In REDAXO before 5.6.3, a critical SQL injection vulnerability has been discovered in the rexlist class because of the prepareQuery function in core/lib/list.php, via the index.php?page=users/users sort parameter. Endangered was the backend and the frontend only if rexlist were used...