CVE-2024-58307
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
CSZCMS 1.3.0 contains an authenticated SQL injection vulnerability in the members view functionality that allows authenticated attackers to manipulate database queries. Attackers can inject malicious SQL code through the view parameter to potentially execute time-based blind SQL injection attacks and extract database information.
Risk Assessment
An authenticated attacker could extract sensitive data from the database or modify its contents.
Recommendation
Update CSZCMS to a patched version and implement parameterized SQL queries.
Other vulnerabilities in CSZCMS
Original NVD description (English source)
CSZCMS 1.3.0 contains an authenticated SQL injection vulnerability in the members view functionality that allows authenticated attackers to manipulate database queries. Attackers can inject malicious SQL code through the view parameter to potentially execute time-based blind SQL injection attacks and extract database information.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS