medium6.5
CVE-2020-26623
Gila CMS SQL Injection
Impact
SQL Injection vulnerability discovered in Gila CMS 1.15.4 and earlier allows a remote attacker to execute arbitrary web scripts via the Area parameter under the Administration>Widget tab after the login portal.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | gilacms/gila | <= 1.15.4 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Gilacms | Gila Cms | through 1.15.4 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/GilaCMS/gila
- https://github.com/GilaCMS/gila/security/policy
- https://packetstormsecurity.com/files/176301/GilaCMS-1.15.4-SQL-Injection.html
- https://github.com/advisories/GHSA-rpjw-97p8-p2xp
- https://nvd.nist.gov/vuln/detail/CVE-2020-26623
- http://gilacms.com