CVE-2018-19558 An issue was discovered in arcms through 2018-03-19. SQL injection exists via the json/newslist limit parameter because of ctl/main/Json.php, ctl/main/service/Data.php, and comp/Db/Mysql.php.
CriticalCVSS 9.8
EPSS 1.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An issue was discovered in arcms through 2018-03-19. SQL injection exists via the json/newslist limit parameter because of ctl/main/Json.php, ctl/main/service/Data.php, and comp/Db/Mysql.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| arcms project arcms | <= 2018-03-19 | No fix listed |
References
- github.com exploit third-party-advisory