GHSA-54wc-49qj-5ghj
MCMS vulnerable SQL injection via the content_title parameter
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | net.mingsoft:ms-mcms | >= 5.5.0, < 6.0.2 | 6.0.2 |
Details
As written in the advisory (Markdown source, shown as plain text).
A SQL injection vulnerability in the content_title parameter of the /cms/content/list endpoint in MCMS 5.5.0 through 6.0.1 allows remote attackers to execute arbitrary SQL queries via unsanitized input in the FreeMarker template rendering.
References
External links from the advisory. They lead to third-party sites.