core/MY_Security.php in CSZ CMS 1.2.2 before 2019-06-20 has member/login/check SQL injection by sending a crafted HTTP User-Agent header and

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• cszcms csz cmsup to 1.2.2 inclusive

Other highest-scoring records for the same primary product.

• CVE-2019-15524CSZ CMS 1.2.3 allows arbitrary file upload, as demonstrated by a .php file to admin/filemanager in the File Management Module, which leads t
  40Plan
• CVE-2024-25414An arbitrary file upload vulnerability in /admin/upgrade of CSZ CMS v1.3.0 allows attackers to execute arbitrary code via uploading a crafte
  39Monitor
• CVE-2022-27165CSZ CMS 1.2.2 is vulnerable to SQL Injection via cszcms_admin_Plugin_manager_setstatus
  39Monitor
• CVE-2022-27164CSZ CMS 1.2.2 is vulnerable to SQL Injection via cszcms_admin_Users_viewUsers
  39Monitor
• CVE-2022-27163CSZ CMS 1.2.2 is vulnerable to SQL Injection via cszcms_admin_Users_editUser
  39Monitor
• CVE-2022-27162CSZ CMS 1.2.2 is vulnerable to SQL Injection via cszcms_admin_Members_editUser
  39Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

The query text is built by concatenating user input. The database cannot tell where the data ends and the command begins.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1const owner = req.query.owner;2const rows = await db.query(3  "SELECT * FROM files WHERE owner = '" + owner + "'"4);

1const owner = req.query.owner;2const rows = await db.query(3  "SELECT * FROM files WHERE owner = $1",4  [owner]5);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.