CVE-2018-14472 SQL injection in n/a
SQL injection in WUZHI CMS allows attackers to manipulate database queries via the keywords parameter in the order admin module.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-14472?
CVE-2018-14472 is a high-severity SQL injection vulnerability in Wuzhicms Wuzhicms, published on 20 Jul 2018. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
An issue was discovered in WUZHI CMS 4.1.0. The vulnerable file is coreframe/app/order/admin/goods.php. The $keywords parameter is taken directly into execution without any filtering, leading to SQL injection.
Weakness: CWE-89
Which versions are affected by CVE-2018-14472?
It affects 1 product.
Products include Wuzhicms Wuzhicms.
How do I fix CVE-2018-14472?
No fix has been published for CVE-2018-14472 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2018-14472 being exploited?
There is no known exploitation of CVE-2018-14472 in the wild and no public exploit code.
Other vulnerabilities in Wuzhicms Wuzhicms
Sources
Also known as GHSA-jh3w-6v54-jq6h.