CVE-2017-1000067

HIGH8.8EPSS 0.55%

MODX Revolution blind SQL injection

Published: 5/17/2022Modified: 4/23/2024

Description

MODX Revolution version 2.x - 2.5.6 is vulnerable to blind SQL injection caused by improper sanitization by the escape method resulting in authenticated user accessing database and possibly escalating privileges.

Affected packages (1)

Packagist/modx/revolution>= 2.0.0, < 2.6.0

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH8.8	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References (4)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2017-1000067
PATCHhttps://github.com/modxcms/revolution
WEBhttps://github.com/modxcms/revolution/blob/2.x/core/xpdo/changelog.txt#L48
WEBhttps://github.com/modxcms/revolution/blob/9bf1c6cf7bdc12190b404f93ce7798b39c07bc59/core/xpdo/changelog.txt