CVE-2021-28242: SQL Injection
SQL Injection in the "evoadm.php" component of b2evolution v7.2.2-stable allows remote attackers to obtain sensitive database information by injecting SQL commands into the "cfname" parameter when creating a new filter under the "Collections" tab.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2021-28242?
CVE-2021-28242 has been classified as a high severity vulnerability due to the potential for remote attackers to obtain sensitive database information.
How do I fix CVE-2021-28242?
To fix CVE-2021-28242, update to the latest version of b2evolution that addresses this SQL injection vulnerability.
What is the impact of exploiting CVE-2021-28242?
Exploiting CVE-2021-28242 allows attackers to execute arbitrary SQL commands, potentially exposing sensitive data stored in the database.
Which versions of b2evolution are affected by CVE-2021-28242?
CVE-2021-28242 affects b2evolution version 7.2.2 and potentially earlier versions.
Is user input validation sufficient to mitigate CVE-2021-28242?
User input validation alone may not be sufficient to fully mitigate CVE-2021-28242, and implementation of prepared statements is recommended.