vendor:
CMS Ortus
by:
otmorozok428
7.5
CVSS
HIGH
SQL Injection
89
CWE
Product Name: CMS Ortus
Affected Version From: 1.12
Affected Version To: 1.13
Patch Exists: NO
Related CWE: N/A
CPE: a:ortus:cms_ortus
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2008
SQL Injection Vulnerability in POST Form
A SQL injection vulnerability exists in the POST form of CMS Ortus 1.12 and 1.13. An attacker can exploit this vulnerability by registering on the website, authenticating, and then editing the user profile. The attacker can then inject malicious SQL code into the “City” field to gain admin rights and access the admin area.
Mitigation:
Input validation should be used to prevent SQL injection attacks.
