CVE-2018-12039 - joyplus-cms 1.6.0 allows Remote Code Execution because of an Arbitrary SQL command execution issue in manager/index.php involving use of a "/!select/" substring in place of a select substring

Back Back to CVE browser

CRITICAL

joyplus-cms 1.6.0 allows Remote Code Execution because of an Arbitrary SQL command execution issue in manager/index.php involving use of a "/!select/" substring in place of a select substring

Published Jun 7, 2018

9.8

CRITICAL

CVSS 3.0

EPSS 4.68%

Description

joyplus-cms 1.6.0 allows Remote Code Execution because of an Arbitrary SQL command execution issue in manager/index.php involving use of a "/!select/" substring in place of a select substring.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-4022
Advisory
https://github.com/joyplus/joyplus-cms/issues/425
x_refsource_MISCExploitThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-4022		Advisory
https://github.com/joyplus/joyplus-cms/issues/425		x_refsource_MISCExploitThird Party Advisory