CVE-2021-37787

MEDIUM

abo.cms 5.8-5.9.3 - SQL Injection via TinyMCE Module POST Request

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2021-37787. PoCs published by vasykor.

AI-analyzed exploit summary This repository contains a functional proof-of-concept for CVE-2021-37787, demonstrating an SQL injection vulnerability in ABO.CMS via the TinyMCE module. The PoC includes a crafted POST request targeting the login_session_auth.php endpoint, which can lead to unauthorized data access or manipulation.

Description

The unprivileged administrative interface in ABO.CMS version 5.8 through v.5.9.3 is affected by a SQL Injection vulnerability via a HTTP POST request to the TinyMCE module

Exploits (1)

nomisec WORKING POC
by vasykor · poc
https://github.com/vasykor/CVE-2021-37787

This repository contains a functional proof-of-concept for CVE-2021-37787, demonstrating an SQL injection vulnerability in ABO.CMS via the TinyMCE module. The PoC includes a crafted POST request targeting the login_session_auth.php endpoint, which can lead to unauthorized data access or manipulation.

Classification
Working Poc 90%
Attack Type
Sqli
Complexity
Trivial
Reliability
Reliable
Target: ABO.CMS versions 5.8.x, 5.9.3
No auth needed
Prerequisites: Access to the vulnerable endpoint · TinyMCE module enabled
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (1)

Core 1
Core References

Scores

CVSS v3 6.5
EPSS 0.0031
EPSS Percentile 22.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-89
Status published
Products (1)
abocms/abo.cms 5.8 - 5.9.3
Published Mar 11, 2025
Tracked Since Feb 18, 2026