Vulnerability Description
JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection.
CVSS Score
8.8
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Jflyfox | Jfinal Cms | 5.1.0 |
Related Weaknesses (CWE)
References
- https://github.com/AgainstTheLight/CVE-2022-37209/tree/mainExploitThird Party Advisory
- https://github.com/AgainstTheLight/someEXP_of_jfinal_cms/blob/main/jfinal_cms/sqExploitThird Party Advisory
- https://github.com/AgainstTheLight/CVE-2022-37209/tree/mainExploitThird Party Advisory
- https://github.com/AgainstTheLight/someEXP_of_jfinal_cms/blob/main/jfinal_cms/sqExploitThird Party Advisory
FAQ
What is CVE-2022-37209?
CVE-2022-37209 is a vulnerability with a CVSS score of 8.8 (HIGH). JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection.
How severe is CVE-2022-37209?
CVE-2022-37209 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-37209?
Check the references section above for vendor advisories and patch information. Affected products include: Jflyfox Jfinal Cms.