GHSA-q863-cchm-c6c6
SQL Injection in Fork CMS
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | forkcms/forkcms | < 5.11.1 | 5.11.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
Fork CMS contains a SQL injection vulnerability in versions prior to version 5.11.1. When deleting submissions which belong to a formular (made with module `FormBuilder`), the parameter `id[]` is vulnerable to SQL injection.
References
External links from the advisory. They lead to third-party sites.