CVE-2017-11174

Critical

Published: 12/07/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

In install/page_dbsettings.php in the Core distribution of XOOPS 2.5.8.1, unfiltered data passed to CREATE and ALTER SQL queries caused SQL Injection in the database settings page.

Risk Assessment

An attacker could exploit this vulnerability to execute unauthorized SQL queries, potentially leading to data disclosure or modification of the database.

Recommendation

It is recommended to upgrade to the latest version of XOOPS and implement input data filtering in SQL queries.

Original NVD description (English source)

In install/page_dbsettings.php in the Core distribution of XOOPS 2.5.8.1, unfiltered data passed to CREATE and ALTER SQL queries caused SQL Injection in the database settings page, related to use of GBK in CHARACTER SET and COLLATE clauses.