CVE-2024-58307

HighCVSS 8.8/10Last modified Oct 27, 2026

Description

CSZCMS 1.3.0 contains an authenticated SQL injection vulnerability in the members view functionality that allows authenticated attackers to manipulate database queries. Attackers can inject malicious SQL code through the view parameter to potentially execute time-based blind SQL injection attacks and extract database information.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
cszcms	CSZCMS	1.3.0

References

https://sourceforge.net/projects/cszcms/files/install/CSZCMS-V1.3.0.zip/downloadProduct
https://www.cszcms.com/Product
https://www.exploit-db.com/exploits/51916Exploit, Third Party Advisory, VDB Entry
https://www.vulncheck.com/advisories/cszcms-authenticated-sql-injection-via-members-view-endpointThird Party Advisory

Timeline

Published: Dec 11, 2025
Last modified: Oct 27, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-583089.8Quick.CMS 6.7 contains a SQL injection vulnerability that allows unauthenticated attackers to bypass login authentication by manipulating th CVE-2024-583099.8xbtitFM 4.1.18 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by inject CVE-2024-58318.8Use after free in Dawn in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially exploit heap corruption via a crafte CVE-2024-583108.7APC Network Management Card 4 contains a path traversal vulnerability that allows unauthenticated attackers to access sensitive system files CVE-2024-583119.8Dormakaba Saflok System 6000 contains a predictable key generation algorithm that allows attackers to derive card access keys from a 32-bit CVE-2024-583127.5xbtitFM 4.1.18 contains a path traversal vulnerability that allows unauthenticated attackers to access sensitive system files by manipulatin CVE-2024-583137.2xbtitFM 4.1.18 contains an insecure file upload vulnerability that allows authenticated attackers with administrative privileges to upload a CVE-2024-583148.8Atcom 100M IP Phones firmware version 2.7.x.x contains an authenticated command injection vulnerability in the web configuration CGI script CVE-2024-583157.8Tosibox Key Service 3.3.0 contains an unquoted service path vulnerability that allows local non-privileged users to potentially execute code CVE-2024-583167.5Online Shopping System Advanced 1.0 contains a SQL injection vulnerability in the payment_success.php script that allows attackers to inject CVE-2024-583175.3A cookie security configuration vulnerability in Kentico Xperience allows attackers to bypass SSL requirements when setting administration c CVE-2024-583186.1A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via the rich text editor compo