SQL Injection in Subrion CMS · CVE-2020-18155 · GitHub Advisory Database · GitHub

SQL Injection in Subrion CMS

Critical severity GitHub Reviewed Published Sep 8, 2021 to the GitHub Advisory Database • Updated Sep 21, 2023

Package

intelliants/subrion (Composer)

Affected versions

<= 4.2.1

Patched versions

None

Description

SQL Injection vulnerability in Subrion CMS v4.2.1 in the search page if a website uses a PDO connection.

References

Published by the National Vulnerability Database

Jul 14, 2021

Reviewed Jul 16, 2021

Published to the GitHub Advisory Database Sep 8, 2021

Last updated Sep 21, 2023

Severity

Critical

9.8

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H