Vulnerability Description
JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection
CVSS Score
8.8
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Jflyfox | Jfinal Cms | 5.1.0 |
Related Weaknesses (CWE)
References
- https://github.com/AgainstTheLight/CVE-2022-37207/blob/main/README.mdThird Party Advisory
- https://github.com/AgainstTheLight/someEXP_of_jfinal_cms/blob/main/jfinal_cms/sqExploitThird Party Advisory
- https://github.com/AgainstTheLight/CVE-2022-37207/blob/main/README.mdThird Party Advisory
- https://github.com/AgainstTheLight/someEXP_of_jfinal_cms/blob/main/jfinal_cms/sqExploitThird Party Advisory
FAQ
What is CVE-2022-37207?
CVE-2022-37207 is a vulnerability with a CVSS score of 8.8 (HIGH). JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection
How severe is CVE-2022-37207?
CVE-2022-37207 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-37207?
Check the references section above for vendor advisories and patch information. Affected products include: Jflyfox Jfinal Cms.