CVE-2014-4194

High

Published: 09/07/2014(UTC)Translated: 17/06/2026(UTC)NVD NIST

Summary

ZeroCMS 1.0 has an SQL injection vulnerability in zero_transact_article.php that allows remote attackers to execute arbitrary SQL commands via the article_id parameter in a Submit Comment action.

Risk Assessment

Attackers may gain access to sensitive data in the database, potentially leading to serious security breaches for the organization.

Recommendation

It is recommended to upgrade to the latest version of ZeroCMS and implement input filtering and validation to prevent SQL injection.

Other vulnerabilities in ZeroCMS 1.0

CVE-2014-4034High
CVE-2014-4034 is an SQL injection vulnerability in zero_view_article.php in ZeroCMS 1.0 that allows remote attackers to execute arbitrary SQL commands via the article_id parameter.

Original NVD description (English source)

SQL injection vulnerability in zero_transact_article.php in ZeroCMS 1.0 allows remote attackers to execute arbitrary SQL commands via the article_id parameter in a Submit Comment action.