CVE-2017-11324

Critical

Published: 24/07/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

An issue was discovered in Tilde CMS version 1.0.1 due to missing escaping of the backtick character, leading to SQL Injection vulnerability in the SELECT query in class.SystemAction.php.

Risk Assessment

Exploitation of this vulnerability could allow an attacker to execute unauthorized queries against the database, potentially leading to data disclosure or modification.

Recommendation

It is recommended to update Tilde CMS to the latest version that includes security patches and to implement proper input validation and sanitization mechanisms.

Original NVD description (English source)

An issue was discovered in Tilde CMS 1.0.1. Due to missing escaping of the backtick character, a SELECT query in class.SystemAction.php is vulnerable to SQL Injection. The vulnerability can be triggered via a POST request to /actionphp/action.input.php with the id parameter.