CVE-2022-37208

CVSS 8.8 HIGHEPSS 1.1%CWE-89

Vexday Risk Score

21Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 8.8EPSS 1.1%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

13 Oct 2022Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

JFinal CMS 5.1.0 is vulnerable to SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

n/a · n/a

References

https://github.com/AgainstTheLight/CVE-2022-37208 https://github.com/AgainstTheLight/someEXP_of_jfinal_cms/blob/main/jfinal_cms/sql5.md