CVE-2022-27985

CRITICALNuclei

Cuppa CMS v1.0 - SQL injection

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2022-27985 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

CuppaCMS v1.0 was discovered to contain a SQL injection vulnerability via /administrator/alerts/alertLightbox.php.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Nuclei templates

1
ProjectDiscoveryCRITICALCuppa CMS v1.0 - SQL injectionCVSS 9.8

CuppaCMS v1.0 was discovered to contain a SQL injection vulnerability via /administrator/alerts/alertLightbox.php.

Impact

Successful exploitation of this vulnerability can lead to unauthorized access, data leakage, and potential compromise of the entire CMS system.

Remediation

Upgrade to the latest version of Cuppa CMS or apply the provided patch to fix the SQL injection vulnerability.

WeaknessesCWE-89
Authorstheamanrawat
Template tagscvecve2022sqlicuppaauthenticatedcuppacmsvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:cuppacms:cuppacms:1.0:*:*:*:*:*:*:*
https://github.com/CuppaCMS/CuppaCMS https://nvd.nist.gov/vuln/detail/CVE-2022-27985 http://cuppa.com/ http://www.cuppacms.com/

Source: ProjectDiscovery

References

4