CVE-2015-3934

Critical

Published: 21/11/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

Fiyo CMS 2.0_1.9.1 has multiple SQL injection vulnerabilities that allow remote attackers to execute arbitrary SQL commands. The attack can be carried out via the 'id' parameter in rating.php or the 'user' parameter in the login process.

Risk Assessment

These vulnerabilities may lead to unauthorized access to the database and exposure of sensitive information. Organizations could face data loss and data modification or deletion.

Recommendation

It is recommended to update Fiyo CMS to the latest version that addresses these vulnerabilities. Additionally, implementing SQL injection prevention mechanisms, such as prepared statements, is advisable.

Original NVD description (English source)

Multiple SQL injection vulnerabilities in Fiyo CMS 2.0_1.9.1 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to apps/app_article/controller/rating.php or (2) user parameter to user/login.