Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
The Quick Search API in CiviCRM 4.2.0 through 4.2.9 and 4.3.0 through 4.3.3 allows remote authenticated users to bypass the validation layer and conduct SQL injection attacks via a direct request to the "second layer" of the API, related to contact.getquick.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
CiviCRM SQL注入漏洞
Vulnerability Description
CiviCRM是一套专用于非营利组织、非政府组织以及公益机构的客户关系管理系统。该系统可作为组织内部的业务管理，也可作为组织的联络、沟通以及追踪志愿者或支持者的关系和状态。 CiviCRM 4.2.0至4.2.9版本和4.3.0至4.3.3版本中的Quick Search API中存在SQL注入漏洞。远程攻击者可通过发送直接请求到API的第二层利用该漏洞绕过验证层，实施SQL注入攻击。
CVSS Information
N/A
Vulnerability Type
N/A