vendor:
BluSky CMS
by:
Snakespc
9
CVSS
HIGH
SQL Injection
89
CWE
Product Name: BluSky CMS
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2009
BluSky CMS Remote SQL Injection Vulnerability
BluSky CMS is prone to a remote SQL injection vulnerability. An attacker can exploit this issue to manipulate SQL queries and gain access to sensitive information that may aid in further attacks. This issue affects the 'news_id' parameter in the 'index.php' script when 'news_act' is set to 'read'. An attacker can exploit this issue to gain access to the application's database, potentially compromising the application and any data made available through it.
Mitigation:
Input validation should be used to prevent SQL injection attacks. Additionally, the application should be configured to use the least-privileged account with the fewest privileges necessary to perform its function.
