CVE-2021-37475

2021-07-2617:15:06

mitre

www.cve.org

navigatecms

sql injection

templates.php

parameter vulnerability

arbitrary query execution

backend database

AI Score

9.8

Confidence

High

EPSS

0.003

Percentile

69.0%

JSON

In NavigateCMS version 2.9.4 and below, function in templates.php is vulnerable to sql injection on parameter template-properties-order, which results in arbitrary sql query execution in the backend database.

References

gist.github.com/victomteng1997/ed429fed7de46651c89f05e7591fd4fe

github.com/NavigateCMS/Navigate-CMS

github.com/NavigateCMS/Navigate-CMS/issues/26