Skip to main content

Taocms CVE-2021-25784

HIGH
SQL Injection (CWE-89)
2021-12-02 cve@mitre.org
7.2
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.2 HIGH
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Dec 02, 2021 - 23:15 nvd
HIGH 7.2

DescriptionNVD

Taocms v2.5Beta5 was discovered to contain a blind SQL injection vulnerability via the function Edit Article.

AnalysisAI

Taocms v2.5Beta5 was discovered to contain a blind SQL injection vulnerability via the function Edit Article. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified as SQL Injection (CWE-89), which allows attackers to execute arbitrary SQL commands against the database. Taocms v2.5Beta5 was discovered to contain a blind SQL injection vulnerability via the function Edit Article. Affected products include: Taogogo Taocms.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Use parameterized queries/prepared statements. Never concatenate user input into SQL. Apply least-privilege database permissions.

More in Taocms

View all
CVE-2022-25578 CRITICAL POC
9.8 Mar 18

taocms v3.0.2 allows attackers to execute code injection via arbitrarily editing the .htaccess file. Rated critical seve

CVE-2022-36262 CRITICAL POC
9.8 Aug 15

An issue was discovered in taocms 3.0.2. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,

CVE-2024-33350 CRITICAL POC
9.8 Apr 29

Directory Traversal vulnerability in TaoCMS v.3.0.2 allows a remote attacker to execute arbitrary code and obtain sensit

CVE-2023-1947 CRITICAL POC
9.8 Apr 07

A vulnerability was found in taoCMS 3.0.2. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitabl

CVE-2022-23880 CRITICAL POC
9.8 Mar 23

An arbitrary file upload vulnerability in the File Management function module of taoCMS v3.0.2 allows attackers to execu

CVE-2022-25505 CRITICAL POC
9.8 Mar 21

Taocms v3.0.2 was discovered to contain a SQL injection vulnerability via the id parameter in \include\Model\Category.ph

CVE-2021-45014 CRITICAL POC
9.8 Dec 14

There is an upload sql injection vulnerability in the background of taocms 3.0.2 in parameter id:action=cms&ctrl=update&

CVE-2019-7720 CRITICAL POC
9.8 Feb 11

taocms through 2014-05-24 allows eval injection by placing PHP code in the install.php db_name parameter and then making

CVE-2022-36261 CRITICAL POC
9.1 Aug 23

An arbitrary file deletion vulnerability was discovered in taocms 3.0.2, that allows attacker to delete file in server w

CVE-2021-45015 CRITICAL POC
9.1 Dec 14

taocms 3.0.2 is vulnerable to arbitrary file deletion via taocms\include\Model\file.php from line 60 to line 72. Rated c

CVE-2022-23380 HIGH POC
8.8 Mar 01

There is a SQL injection vulnerability in the background of taocms 3.0.2 in parameter id:action=admin&id=2&ctrl=edit. Ra

CVE-2022-23387 HIGH POC
7.5 Mar 01

An issue was discovered in taocms 3.0.2. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no

Share

CVE-2021-25784 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy