CVE-2023-1321

MEDIUM

lmxcms 1.41 - SQL Injection via AcquisiAction.class.php update Function

Title source: llm

Description

A vulnerability has been found in lmxcms 1.41 and classified as critical. Affected by this vulnerability is the function update of the file AcquisiAction.class.php. The manipulation of the argument id with the input -1 and updatexml(0,concat(0x7e,user()),1)# leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-222727.

References (2)

Core 2

Core References

Permissions Required, Third Party Advisory vdb-entry technical-description

https://vuldb.com/?id.222727

Permissions Required, Third Party Advisory signature

https://vuldb.com/?ctiid.222727

Scores

CVSS v3 6.3

EPSS 0.0049

EPSS Percentile 38.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-89

Status published

Products (1)

lmxcms/lmxcms 1.41

Published Mar 10, 2023

Tracked Since Feb 18, 2026