CVE-2017-11418

Critical

Published: 18/07/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

Fiyo CMS version 2.0.7 has an SQL injection vulnerability in article_list.php that uses the parameters $_GET['cat'], $_GET['user'], $_GET['level'], and $_GET['iSortCol_'.$i].

Risk Assessment

Exploitation of this vulnerability may lead to unauthorized access to the database and exposure of sensitive information.

Recommendation

It is recommended to update Fiyo CMS to the latest version and implement input data filtering and validation.

Original NVD description (English source)

Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app_article/controller/article_list.php via $_GET['cat'], $_GET['user'], $_GET['level'], and $_GET['iSortCol_'.$i].