CVE-2023-3528
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
A critical vulnerability was found in ThinuTech ThinuCMS version 1.5. Manipulation of the cat_id argument in the /category.php file leads to SQL injection, which can be exploited remotely.
Risk Assessment
This vulnerability may allow attackers to remotely execute unauthorized database queries, potentially leading to data disclosure or modification.
Recommendation
It is recommended to update ThinuCMS to the latest version and implement input data filtering to prevent SQL injection.
Other vulnerabilities in ThinuTech ThinuCMS 1.5
See all- CVE-2023-3542Low
A vulnerability was found in ThinuTech ThinuCMS version 1.5 that allows cross site scripting (XSS) attacks through manipulation of arguments in the /contact.php file.
- CVE-2023-3541Low
A vulnerability has been found in ThinuTech ThinuCMS version 1.5 that allows cross-site scripting (XSS) attacks through manipulation of the 'author' argument in the /author_posts.php file. Injecting malicious scripts can lead to unauthorized code execution in users' browsers.
Original NVD description (English source)
A vulnerability was found in ThinuTech ThinuCMS 1.5. It has been rated as critical. Affected by this issue is some unknown functionality of the file /category.php. The manipulation of the argument cat_id leads to sql injection. The attack may be launched remotely. The identifier of this vulnerability is VDB-233252.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS