Vulnerability Description
JFinal CMS 5.1.0 is vulnerable to SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection.
CVSS Score
9.8
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Jflyfox | Jfinal Cms | 5.1.0 |
Related Weaknesses (CWE)
References
- https://github.com/AgainstTheLight/CVE-2022-37203/blob/main/README.mdThird Party Advisory
- https://github.com/AgainstTheLight/someEXP_of_jfinal_cms/blob/main/jfinal_cms/sqExploitThird Party Advisory
- https://github.com/AgainstTheLight/CVE-2022-37203/blob/main/README.mdThird Party Advisory
- https://github.com/AgainstTheLight/someEXP_of_jfinal_cms/blob/main/jfinal_cms/sqExploitThird Party Advisory
FAQ
What is CVE-2022-37203?
CVE-2022-37203 is a vulnerability with a CVSS score of 9.8 (CRITICAL). JFinal CMS 5.1.0 is vulnerable to SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection.
How severe is CVE-2022-37203?
CVE-2022-37203 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2022-37203?
Check the references section above for vendor advisories and patch information. Affected products include: Jflyfox Jfinal Cms.