Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
SQL injection vulnerability in File::find (filesystem/File.php) in SilverStripe before 2.3.1 allows remote attackers to execute arbitrary SQL commands via the filename parameter.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
SilverStripe filename参数 SQL注入漏洞
Vulnerability Description
SilverStripe是一款功能强大的CMS内容管理系统。 在SilverStripe中File::find($filename)使用SQL查询找到所请求的文件名，而所请求的文件名未经SQL转义便用作了查询参数。由于File::find内部调用DataObject::get_one时用单引号包围其SQL参数，使用单引号$filename就可能允许攻击者在请求中附加第二个查询。
CVSS Information
N/A
Vulnerability Type
N/A