CVE-2024-58301
CriticalSummary
Purei CMS 1.0 contains a time-based blind SQL injection vulnerability that allows attackers to manipulate database queries through unfiltered user input parameters. Attackers can exploit vulnerable endpoints like getAllParks.php and events-ajax.php by injecting crafted SQL payloads to potentially extract or modify database information.
Risk Assessment
An attacker can access or modify sensitive data, potentially leading to data integrity and privacy breaches.
Recommendation
It is recommended to update Purei CMS to the latest version and implement input filtering and parameterized queries to prevent SQL injection.
Original NVD description (English source)
Purei CMS 1.0 contains a time-based blind SQL injection vulnerability that allows attackers to manipulate database queries through unfiltered user input parameters. Attackers can exploit vulnerable endpoints like getAllParks.php and events-ajax.php by injecting crafted SQL payloads to potentially extract or modify database information.