Lucene search

Veracode Vulnerability DatabaseVERACODE:44928

HistoryJan 04, 2024 - 5:01 a.m.

SQL Injection

2024-01-0405:01:25

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

sql injection

gilacms

user_id parameter

web scripts

software vulnerability

8.1 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

44.3%

JSON

gilacms/gila is vulnerable to SQL Injection. The vulnerability is due to improper user_id parameter sanitization within the login portal, which allows an attacker to execute arbitrary web scripts which results in SQL injection.

CPENameOperatorVersion
gilacms/gilalev115.x-dev
gilacms/gilalev115.x-dev

CPE	Name	Operator	Version
	gilacms/gila	le	v115.x-dev
	gilacms/gila	le	v115.x-dev

References

gilacms.com

github.com/advisories/GHSA-3pfj-g4wr-qj3j

github.com/GilaCMS/gila

github.com/GilaCMS/gila/security/policy

packetstormsecurity.com/files/176301/GilaCMS-1.15.4-SQL-Injection.html