Vulnerabilities
Projects
Vulnerability Disclosure
About Us
Contact Us
Mend.io Vulnerability Database
What is a WS vulnerability ID?
What is an MSC vulnerability ID?
We found results for “”
WS-2022-0424
Good to know:
Date: November 3, 2022
thorsten/phpmyfaq before 3.1.9 is vulnerable to SQL Injection inside instance name that leads to Remote Code Execution. An attacker has a severe impact by being allowed to recover all or part of your database (including sensitive data like usernames and passwords hash), Modify or insert data in the database, saturate database workers with resource-intensive math functions, read or write files on the disk and execute OS commands.
Language: PHP
Severity Score
Severity Score
Weakness Type (CWE)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-89Top Fix
Upgrade Version
Upgrade to version thorsten/phpmyfaq - 2.5.2;thorsten/phpmyfaq - 2.8.0-alpha;thorsten/phpmyfaq - 3.1.9;thorsten/phpmyfaq - dev-main;phpmyfaq/phpmyfaq - 2.5.2;phpmyfaq/phpmyfaq - 3.1.9;phpmyfaq/phpmyfaq - 2.8.0-alpha;phpmyfaq/phpmyfaq - 3.0.10;phpmyfaq/phpmyfaq - 2.9.11;phpmyfaq/phpmyfaq - 3.0.0-alpha.3;phpmyfaq/phpmyfaq - 3.1.2;phpmyfaq/phpmyfaq - dev-snyk-fix-6a9cf43a8fc92d6d608c7e5595d1e588
CVSS v3.1
| Base Score: |
|
|---|---|
| Attack Vector (AV): | NETWORK |
| Attack Complexity (AC): | LOW |
| Privileges Required (PR): | HIGH |
| User Interaction (UI): | NONE |
| Scope (S): | UNCHANGED |
| Confidentiality (C): | HIGH |
| Integrity (I): | HIGH |
| Availability (A): | HIGH |