New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

There is SQL blind injection at "Edit article"(Column administrator authority) #4

Closed

ddddbhm opened this issue Jan 5, 2021 · 1 comment

ddddbhm commented Jan 5, 2021

First, we enter the background and use the column administrator admin1 we created:

We click in order and grab packets:

There is a blind SQL injection vulnerability in the location of id:

poc:/admin/admin.php?action=cms&id=30+and+1=3&ctrl=edit

Owner

taogogo commented Mar 3, 2021

3.0.1 fixed, thanks for your contribution

taogogo closed this as completed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment