MingSoft MCMS vulnerabilities

A security flaw was discovered in MingSoft MCMS up to version 3.0.6, leading to information disclosure in an unknown function of the file /mdiy/form/get in the ms-mdiy component. The attack can be launched remotely. The exploit has been publicly released.

A vulnerability was identified in MingSoft MCMS up to version 3.0.6, leading to information disclosure in an unknown function of the file /mdiy/form/data/list in the ms-mdiy component. The attack can be initiated remotely. The exploit is publicly available.

A vulnerability was identified in MingSoft MCMS up to version 3.0.6, affecting the ModelDataImpl.queryDiyFormData function in the file /mdiy/form/data/list.do of the ms-mdiy component. Manipulating the formFields argument leads to SQL injection. The attack can be performed remotely, and the exploit has been publicly disclosed.

A SQL injection vulnerability was detected in mingSoft MCMS up to version 5.5.0, affecting the list function in ContentAction.java within the Web Content List Endpoint component. Input manipulation leads to SQL injection. The attack can be initiated remotely, and the exploit has been publicly disclosed.