CVE-2018-6893 controllers/member/Api.php in dayrui FineCms 5.2.0 has SQL Injection: a request with s=member,c=api,m=checktitle, and the parameter 'module' with a SQL statement, lacks effective filtering.
CriticalCVSS 9.8
EPSS 2.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
controllers/member/Api.php in dayrui FineCms 5.2.0 has SQL Injection: a request with s=member,c=api,m=checktitle, and the parameter 'module' with a SQL statement, lacks effective filtering.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| finecms | = 5.2.0 | No fix listed |
References
- xianzhi.aliyun.com broken-link