Bootstrapy CMS Lastest Multiple SQL Injection via Forum and Contact Modules

Bootstrapy CMS contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through POST parameters. Attackers can inject SQL payloads into the thread_id parameter of forum-thread.php, the subject parameter of contact-submit.php, the post-id parameter of post-new-submit.php, and the thread-id parameter to extract sensitive database information or cause denial of service.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

SQL命令中使用的特殊元素转义处理不恰当(SQL注入)

Bootstrapy CMS SQL注入漏洞

Bootstrapy CMS是Bootstrapy开源的一个内容管理系统。 Bootstrapy CMS存在SQL注入漏洞，该漏洞源于多个SQL注入，可能导致未经身份验证的攻击者通过forum-thread.php的thread_id参数、contact-submit.php的subject参数、post-new-submit.php的post-id参数和thread-id参数注入恶意代码执行任意SQL查询。

N/A

N/A