Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
CSZ CMS 1.2.2 is vulnerable to SQL Injection via cszcms_admin_Users_editUser
AnalysisAI
CSZ CMS 1.2.2 is vulnerable to SQL Injection via cszcms_admin_Users_editUser. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Technical ContextAI
This vulnerability is classified as SQL Injection (CWE-89), which allows attackers to execute arbitrary SQL commands against the database. CSZ CMS 1.2.2 is vulnerable to SQL Injection via cszcms_admin_Users_editUser Affected products include: Cszcms Csz Cms.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Use parameterized queries/prepared statements. Never concatenate user input into SQL. Apply least-privilege database permissions.
An arbitrary file upload vulnerability in /admin/upgrade of CSZ CMS v1.3.0 allows attackers to execute arbitrary code vi
CSZ CMS 1.2.2 is vulnerable to SQL Injection via cszcms_admin_Plugin_manager_setstatus. Rated critical severity (CVSS 9.
CSZ CMS 1.2.2 is vulnerable to SQL Injection via cszcms_admin_Users_viewUsers. Rated critical severity (CVSS 9.8), this
CSZ CMS 1.2.2 is vulnerable to SQL Injection via cszcms_admin_Members_editUser. Rated critical severity (CVSS 9.8), this
Csz Cms 1.2.2 is vulnerable to SQL Injection via cszcms_admin_Members_viewUsers. Rated critical severity (CVSS 9.8), thi
core/MY_Security.php in CSZ CMS 1.2.2 before 2019-06-20 has member/login/check SQL injection by sending a crafted HTTP U
CSZ CMS 1.2.9 is vulnerable to Arbitrary File Deletion. Rated critical severity (CVSS 9.1), this vulnerability is remote
CSZ CMS 1.1.8 has CSRF via admin/users/new/add. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitab
SQL Injection vulnerability in CSZ-CMS v.1.3.0 allows a remote attacker to execute arbitrary code via the execSqlFile fu
A Cross Site Scripting vulnerability in CSZ CMS v.1.3.0 allows an attacker to execute arbitrary code via a crafted scrip
Multiple cross-site scripting (XSS) vulnerabilities in install/index.php of CSZ CMS v1.3.0 allow attackers to execute ar
CSZ CMS 1.3.0 is vulnerable to cross-site scripting (XSS), which allows attackers to execute arbitrary web scripts or HT
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today