go to Content
:::

TWCERT/CC Taiwan Computer Emergency Response Team/Coordination Center

:::

Date:
Font-stze:

Hyweb HyCMS-J1 - SQL Injection

TVN ID TVN-202101001
CVE ID CVE-2021-22847
CVSS 8.8(High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products Hyweb HyCMS-J1 version prior to 7.4.3
Description Hyweb HyCMS-J1's API fail to filter POST request parameters. Remote attackers can inject SQL syntax and execute commands without privilege.
Solution Update Hyweb HyCMS-J1 to the latest version or contact Hyweb Tech. for vulnerability repairment.
Credit Robin Tung (CHT)
Public Date 2021-01-19
Top