SQL Injection in CMS Made Simple <=2.2.15: Exploiting modules/News/function.admin_articlestab.php

CVE-2021-40961 · HIGH Severity

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CMS Made Simple <=2.2.15 is affected by SQL injection in modules/News/function.admin_articlestab.php. The $sortby variable is concatenated with $query1, but it is possible to inject arbitrary SQL language without using the '.

Learn more about our Cis Benchmark Audit For Microsoft Sql Server.