CVE-2018-17831: SQL Injection
Published Oct 1, 2018
·Updated
In REDAXO before 5.6.3, a critical SQL injection vulnerability has been discovered in the rexlist class because of the prepareQuery function in core/lib/list.php, via the index.php?page=users/users sort parameter. Endangered was the backend and the frontend only if rexlist were used.
Affected Software
1 affected component
REDAXO REDAXO<5.6.3
Event History
Oct 1, 2018
CVE Published
via MITRE·08:00 AM
Data Sourced
via MITRE·08:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2018-17831?
CVE-2018-17831 is classified as a critical SQL injection vulnerability.
2
How do I fix CVE-2018-17831?
To fix CVE-2018-17831, you should update REDAXO to version 5.6.3 or later.
3
What versions of REDAXO are affected by CVE-2018-17831?
Versions of REDAXO prior to 5.6.3 are affected by CVE-2018-17831.
4
What component is vulnerable in CVE-2018-17831?
The vulnerability in CVE-2018-17831 exists in the rex_list class, specifically in the prepareQuery function.
5
Can CVE-2018-17831 affect the frontend of REDAXO?
CVE-2018-17831 can affect the frontend only if the rex_list is utilized in that context.