CVE-2023-3528
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
A critical vulnerability was found in ThinuTech ThinuCMS version 1.5. Manipulation of the cat_id argument in the /category.php file leads to SQL injection, which can be exploited remotely.
Risk Assessment
This vulnerability may allow attackers to remotely execute unauthorized database queries, potentially leading to data disclosure or modification.
Recommendation
It is recommended to update ThinuCMS to the latest version and implement input data filtering to prevent SQL injection.
Original NVD description (English source)
A vulnerability was found in ThinuTech ThinuCMS 1.5. It has been rated as critical. Affected by this issue is some unknown functionality of the file /category.php. The manipulation of the argument cat_id leads to sql injection. The attack may be launched remotely. The identifier of this vulnerability is VDB-233252.