Description
A vulnerability has been found in FastCMS up to 0.1.5 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /api/client/article/list. The manipulation of the argument orderBy leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Metrics
CVSS 3.1 6.3/10
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:LWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| n/a | FastCMS | 0.1.0; 0.1.1; 0.1.2; 0.1.3; 0.1.4; 0.1.5 |
References
- https://github.com/IceFoxH/VULN/issues/8Exploit, Issue Tracking
- https://github.com/IceFoxH/VULN/issues/9Exploit, Issue Tracking
- https://vuldb.com/?ctiid.300577Permissions Required, VDB Entry
- https://vuldb.com/?id.300577Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.517926Third Party Advisory, VDB Entry
- https://github.com/IceFoxH/VULN/issues/8Exploit, Issue Tracking
- https://github.com/IceFoxH/VULN/issues/9Exploit, Issue Tracking
Timeline
- Published
- Mar 21, 2025
- Last modified
- Jun 17, 2026
- NVD status
- Analyzed