CVE-2018-18399 SQL injection vulnerability in the "ContentPlaceHolder1_uxTitle" component in ArchiveNews.aspx in jco.ir KARMA 6.0.0 allows a remote attacker to execute arbitrary SQL commands via the "id" parameter.
CriticalCVSS 9.8
EPSS 2.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
SQL injection vulnerability in the "ContentPlaceHolder1_uxTitle" component in ArchiveNews.aspx in jco.ir KARMA 6.0.0 allows a remote attacker to execute arbitrary SQL commands via the "id" parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| jco karma | = 6.0.0 | No fix listed |
References
- packetstormsecurity.com third-party-advisory vdb-entry
- cxsecurity.com third-party-advisory