CVE Catalog
CVE-2017-11414
CriticalSummary
Fiyo CMS version 2.0.7 has an SQL injection vulnerability in dapur/apps/app_comment/sys_comment.php, using data from $_POST and $_REQUEST.
Risk Assessment
An attacker could exploit this vulnerability to execute unauthorized queries against the database, potentially leading to the disclosure of sensitive information or data manipulation.
Recommendation
It is recommended to update Fiyo CMS to the latest version and implement input filtering and validation in the application.
Original NVD description (English source)
Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app_comment/sys_comment.php via $_POST['comment'], $_POST['name'], $_POST['web'], $_POST['email'], $_POST['status'], $_POST['id'], and $_REQUEST['id'].