GHSA-q863-cchm-c6c6

SQL Injection in Fork CMS

At a glance

Published: 2022-03-25 00:00 UTC
Updated: 2023-11-08 04:07 UTC
CVE: CVE-2022-0153
CVSS_V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Description

Fork CMS contains a SQL injection vulnerability in versions prior to version 5.11.1. When deleting submissions which belong to a formular (made with module `FormBuilder`), the parameter `id[]` is vulnerable to SQL injection.

Affected packages

Package	Versions
Packagist · forkcms/forkcms	introduced 0, fixed 5.11.1

References

https://nvd.nist.gov/vuln/detail/CVE-2022-0153 ADVISORY
https://github.com/forkcms/forkcms/commit/7a12046a67ae5d8cf04face3ee75e55f03a1a608 WEB
https://github.com/forkcms/forkcms PACKAGE
https://huntr.dev/bounties/841503dd-311c-470a-a8ec-d4579b3274eb WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database