CVE-2024-58307
Published: 11 December 2025
Description
CSZCMS 1.3.0 contains an authenticated SQL injection vulnerability in the members view functionality that allows authenticated attackers to manipulate database queries. Attackers can inject malicious SQL code through the view parameter to potentially execute time-based blind SQL injection attacks and…
more
extract database information.
Mitigating Controls (NIST 800-53 r5)AI
Requires validation and sanitization of the 'view' parameter to directly prevent injection of malicious SQL code into database queries.
Mandates timely identification, reporting, and correction of the SQL injection flaw in the CSZCMS members view functionality.
Enables monitoring of database activity to detect unauthorized query manipulations or time-based blind SQL injection attempts.
Security SummaryAI
CSZCMS 1.3.0 is affected by CVE-2024-58307, an authenticated SQL injection vulnerability in the members view functionality. The flaw arises from improper handling of the 'view' parameter, enabling attackers to inject malicious SQL code and manipulate database queries. This includes the potential for time-based blind SQL injection attacks to extract sensitive database information. The vulnerability is classified under CWE-89 with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Authenticated attackers with low privileges can exploit this vulnerability remotely over the network with low complexity and no user interaction required. Successful exploitation allows high-impact outcomes, including unauthorized access to confidential data (C:H), modification of database contents (I:H), and potential denial of service through disruption (A:H). Attackers could extract user credentials, administrative data, or other sensitive information stored in the database.
Advisories from Vulncheck and a proof-of-concept exploit on Exploit-DB provide further technical details on the vulnerability, including reproduction steps via the members view endpoint. The official CSZCMS website and SourceForge download page offer access to the affected version 1.3.0 for analysis. No specific patches or mitigations are detailed in the available references.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing CMS directly enables T1190 (Exploit Public-Facing Application) and facilitates T1213.006 (Data from Information Repositories: Databases) for extracting sensitive data like credentials.