CoreCVE
Back

CRITICAL

In Gxlcms QY v1.0.0713, Lib\Lib\Action\Home\HitsAction.class.php allows remote attackers to read data from a database by embedding a FROM clause in a query string within a Home-Hits request, as demonstrated hy sid=user,password%20from%20mysql.user%23

Published Apr 8, 2018

Description

In Gxlcms QY v1.0.0713, Lib\Lib\Action\Home\HitsAction.class.php allows remote attackers to read data from a database by embedding a FROM clause in a query string within a Home-Hits request, as demonstrated hy sid=user,password%20from%20mysql.user%23.

Affected products

Remediation

No remediation recorded yet.

Metrics

Weaknesses (1)

CWE-200

Exposure of Sensitive Information

References (1)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Apr 8, 2018
Updated Sep 16, 2024
Reserved Apr 7, 2018
Link CVE-2018-9852
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2018-9852
Red Hat
Severity n/a
Public date n/a
Links CVE-2018-9852