github.comrelated
https://github.com/hadagaga/vuln/blob/master/JFinalCMS/sql-1/SQL_injection_vulnerability.md CVE-2024-12351
MEDIUM
JFinalCMS File Content ContentModel.java findPage sql injection
Record summary
CVE-2024-12351 has a selected CVSS score of 5.3 (medium).
Description
A vulnerability classified as critical has been found in JFinalCMS 1.0. This affects the function findPage of the file src\main\java\com\cms\entity\ContentModel.java of the component File Content Handler. The manipulation of the argument name leads to sql injection. It is possible to initiate the attack remotely.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationPoC
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Dec 10, 2024 · Source: CVE List
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
jfinalcmsBrowse jfinalcms_project / jfinalcmsDefault status: unknown | CVE List | 1.0 | affected |
JFinalCMS | CVE List | 1.0 | affected |
References
5nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2024-12351 VDB-287271 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions required
https://vuldb.com/?ctiid.287271 VDB-287271 | JFinalCMS File Content ContentModel.java findPage sql injectionvdb entryTechnical description
https://vuldb.com/?id.287271 Submit #456048 | jwillber JFinalCMS ContentModel.java findPage name 1 SQL InjectionThird-party advisory
https://vuldb.com/?submit.456048