SQL Injection Vulnerability in Tilde CMS 1.0.1

CVE-2017-11324 · HIGH Severity

AV:N/AC:L/AU:N/C:P/I:P/A:P

An issue was discovered in Tilde CMS 1.0.1. Due to missing escaping of the backtick character, a SELECT query in class.SystemAction.php is vulnerable to SQL Injection. The vulnerability can be triggered via a POST request to /actionphp/action.input.php with the id parameter.

Learn more about our Cis Benchmark Audit For Microsoft Sql Server.