CVE-2018-7474 An issue was discovered in Textpattern CMS 4.6.2 and earlier. It is possible to inject SQL code in the variable "qty" on the page index.php.
CriticalCVSS 9.8
EPSS 6.2%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
An issue was discovered in Textpattern CMS 4.6.2 and earlier. It is possible to inject SQL code in the variable "qty" on the page index.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| textpattern | <= 4.6.2 | No fix listed |
References
- 20180313 SQL Injection in Textpattern <= 4.6.2 exploit mailing-list third-party-advisory
- 44277 exploit third-party-advisory vdb-entry