CVE-2018-9852

Published: Apr 8, 2018Modified: Nov 21, 2024

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

In Gxlcms QY v1.0.0713, Lib\Lib\Action\Home\HitsAction.class.php allows remote attackers to read data from a database by embedding a FROM clause in a query string within a Home-Hits request, as demonstrated hy sid=user,password%20from%20mysql.user%23.

Affected (1)

Products: Gxlcms: Gxlcms Qy

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Gxlcms Gxlcms Qy	Version 1.0.0713

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (2)

http://www.atksec.com/cve/GxlcmsQY-v1.0.0713-sqli/index.html

Source: cve@mitre.org

ExploitThird Party Advisory

http://www.atksec.com/cve/GxlcmsQY-v1.0.0713-sqli/index.html

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.