Description
ImpressCMS 1.3.11 contains a time-based blind SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the 'bid' parameter. Attackers can send POST requests to the admin.php endpoint with malicious 'bid' values containing SQL commands to extract sensitive database information.
Exploits (1)
References (4)
Core 4
Core References
Product product
Product Reference
https://sourceforge.net/projects/impresscms/files/v1.3.11/impresscms_1.3.11.zip
Third Party Advisory third-party-advisory
VulnCheck Advisory: ImpressCMS 1.3.11 SQL Injection via bid Parameter
https://www.vulncheck.com/advisories/impresscms-sql-injection-via-bid-parameter
Scores
CVSS v3
7.1
EPSS
0.0005
EPSS Percentile
16.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
partial
Details
CWE
CWE-89
Status
published
Products (2)
impresscms/impresscms
1.3.11
Impresscms/ImpressCMS
1.3.11
Published
Apr 12, 2026
Tracked Since
Apr 12, 2026