# CVE-2025-22964: Time-based blind SQL injection in DDSN Interactive cm3 Acora CMS version 10.1.1
DDSN Interactive cm3 Acora CMS version 10.1.1 has a time-based blind SQL Injection vulnerability caused by insufficient input sanitization and validation in the "table" parameter. This flaw allows attackers to inject malicious SQL queries by directly incorporating user-supplied input into database queries without proper escaping or validation. Exploiting this issue enables unauthorized access, manipulation of data, or exposure of sensitive information, posing significant risks to the integrity and confidentiality of the application.
Affected version: Acora CMS v10.1.1 and possibly other versions
Discovered by Joby Y Daniel, December-2024.
登录后查看神龙缓存的 POC 文件快照
登录查看