CVE-2019-9693: SQL Injection
In CMS Made Simple (CMSMS) before 2.2.10, an authenticated user can achieve SQL Injection in class.showtime2data.php via the functions updateshow (parameter showid), inputshow (parameter showid), Getshowinfo (parameter showid), Getpictureinfo (parameter pictureid), AdjustNameSeq (parameter shownumber), Updatepicture (parameter pictureid), and Deletepicture (parameter pictureid).
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2019-9693?
CVE-2019-9693 is considered a critical vulnerability due to its potential for SQL Injection.
How do I fix CVE-2019-9693?
To fix CVE-2019-9693, update CMS Made Simple to version 2.2.10 or later.
Who is affected by CVE-2019-9693?
Authenticated users of CMS Made Simple versions prior to 2.2.10 are affected by CVE-2019-9693.
What type of vulnerability is CVE-2019-9693?
CVE-2019-9693 is a SQL Injection vulnerability.
What components of CMS Made Simple are vulnerable in CVE-2019-9693?
The functions in class.showtime2_data.php, specifically related to show_id and picture_id parameters, are vulnerable in CVE-2019-9693.