CVE-2024-58307 CSZCMS 1.3.0 Authenticated SQL Injection via Members View Endpoint
Authenticated attackers can inject SQL via the members view endpoint to extract database information from CSZCMS.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-58307?
CVE-2024-58307 is a critical SQL injection vulnerability in CSZCMS, published on 11 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
CSZCMS 1.3.0 contains an authenticated SQL injection vulnerability in the members view functionality that allows authenticated attackers to manipulate database queries. Attackers can inject malicious SQL code through the view parameter to potentially execute time-based blind SQL injection attacks and extract database information.
Weakness: CWE-89
Which versions are affected by CVE-2024-58307?
It affects 1 product.
Products include Cszcms Csz Cms.
How do I fix CVE-2024-58307?
No fix has been published for CVE-2024-58307 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2024-58307 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-58307 exists.
Other vulnerabilities in CSZCMS
Sources
Also known as GHSA-hgp5-7jww-4753.