GHSA-phhm-6pgm-mxw9

ghsaUSosv

MODX Revolution blind SQL injection

view advisory published 2022-05-17Licence: CC-BY-4.0

MODX Revolution version 2.x - 2.5.6 is vulnerable to blind SQL injection caused by improper sanitization by the escape method resulting in authenticated user accessing database and possibly escalating privileges.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2017-1000067US	high8.8	1.11% (66th)	—	2017-07-17
MODX Revolution version 2.x - 2.5.6 is vulnerable to blind SQL injection caused by improper sanitization by the escape method resulting in authenticated user accessing database and…

references

External citations — patches, advisories, analysis.

https://github.com/modxcms/revolutionPACKAGE
https://github.com/modxcms/revolution/blob/2.x/core/xpdo/changelog.txt#L48WEB
https://github.com/modxcms/revolution/blob/9bf1c6cf7bdc12190b404f93ce7798b39c07bc59/core/xpdo/changelog.txtWEB
https://nvd.nist.gov/vuln/detail/CVE-2017-1000067ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan