vendor:
psi-cms
by:
learn3r hacker from nepal
7,5
CVSS
HIGH
SQL Injection
89
CWE
Product Name: psi-cms
Affected Version From: 0.3.1
Affected Version To: 0.3.1
Patch Exists: NO
Related CWE: N/A
CPE: psi-cms
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: None
2020
PSI CMS v. 0.3.1 SQLi Vulns
This product suffers from multiple SQLi vulnerabilities. The first exploit is a union-based SQL injection attack, which can be used to extract the version of the database, the database name, and the user. The other two exploits are parameter-based SQL injections, which can be used to execute arbitrary SQL queries.
Mitigation:
Input validation and sanitization should be used to prevent SQL injection attacks. Additionally, web application firewalls can be used to detect and block malicious requests.
