CVE-2021-40961: SQL Injection
Published Jun 9, 2022
·Updated
CMS Made Simple <=2.2.15 is affected by SQL injection in modules/News/function.adminarticlestab.php. The $sortby variable is concatenated with $query1, but it is possible to inject arbitrary SQL language without using the '.
Affected Software
1 affected component
CMSmadesimple CMS Made Simple<=2.2.15
Event History
Jun 9, 2022
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Frequently Asked Questions
1
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2021-40961.
2
What is the severity of CVE-2021-40961?
CVE-2021-40961 has a severity rating of 8.8 (high).
3
What software versions are affected by this vulnerability?
CMS Made Simple versions up to and including 2.2.15 are affected by CVE-2021-40961.
4
What is the CWE ID for this vulnerability?
The CWE ID for CVE-2021-40961 is CWE-89.
5
How can I fix the SQL injection vulnerability in CMS Made Simple?
To fix the SQL injection vulnerability in CMS Made Simple, you should update to a version that is not affected, such as version 2.2.16 or later.