CMSsite 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the cat_id parameter. Attackers can send GET requests to category.php with malicious cat_id values to extract sensitive database information including usernames and credentials.
| Vendor | Product | Versions |
|---|---|---|
| victoralagwu | cmssite | 1.0 |
Updated severity to CRITICAL and marked the vulnerability as actively exploited with an exploit available.
Initial creation
