CVE-2024-58308
CriticalSummary
Quick.CMS 6.7 contains a SQL injection vulnerability that allows unauthenticated attackers to bypass login authentication by manipulating the login form. Attackers can inject specific SQL payloads like ' or '1'='1 to gain unauthorized administrative access to the system.
Risk Assessment
Unauthorized administrative access can lead to full compromise of the CMS, including content modification and data theft.
Recommendation
It is recommended to immediately update Quick.CMS to the latest version and apply SQL injection protections such as parameterized queries.
Original NVD description (English source)
Quick.CMS 6.7 contains a SQL injection vulnerability that allows unauthenticated attackers to bypass login authentication by manipulating the login form. Attackers can inject specific SQL payloads like ' or '1'='1 to gain unauthorized administrative access to the system.