CVE-2024-31212

HIGH EPSS 53.7%
Published Apr 4, 20242y ago · Modified Jun 17, 20261w ago
7.2 CVSS 3.1
High
Find Similar
Published Apr 4, 2024 2y ago
Last Modified Jun 17, 2026 1w ago

Description

InstantCMS is a free and open source content management system. A SQL injection vulnerability affects instantcms v2.16.2 in which an attacker with administrative privileges can cause the application to execute unauthorized SQL code. The vulnerability exists in index_chart_data action, which receives an input from user and passes it unsanitized to the core model `filterFunc` function that further embeds this data in an SQL statement. This allows attackers to inject unwanted SQL code into the statement. The `period` should be escaped before inserting it in the query. As of time of publication, a patched version is not available.

CVSS Details

Base Score
7.2
Exploitability
1.2
Impact
5.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required High
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
53.7% percentile
Exploit & Patch Status
Public Exploit Known
No Patch Available

Weaknesses 2

CWE-20 Improper Input Validation Validation
CWE-89 SQL Injection Injection

Affected Products 1

VendorProductVersionRange
instantcmsinstantcms2.16.2any

References 4

  • github.com https://github.com/instantsoft/icms2/blob/4691a1524780e74107f6009b48d91e17a81b0fa1/system/controllers/admin/actions/index_chart_data.php#L190
    Product
  • github.com https://github.com/instantsoft/icms2/blob/4691a1524780e74107f6009b48d91e17a81b0fa1/system/core/model.php#L744
    Product
  • github.com https://github.com/instantsoft/icms2/security/advisories/GHSA-qx95-w566-73fw
    ExploitVendor Advisory
  • user-images.githubusercontent.com https://user-images.githubusercontent.com/109034767/300806111-a33d9548-d99f-4034-bef3-fbd7fa62c37f.png
    Permissions Required

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.