CVE-2018-25179 - Vulnerability Analysis

Overview

Gumbo CMS 0.99 contains an sql injection caused by unsanitized input in the language parameter at the settings endpoint, letting unauthenticated attackers execute arbitrary SQL queries and extract sensitive database information.

Severity & Score

Impact

Unauthenticated attackers can execute arbitrary SQL queries to extract sensitive database information, compromising data confidentiality and integrity.

Mitigation

Update Gumbo CMS to the latest version.

References

• https://www.exploit-db.com/exploits/45837
• https://www.vulncheck.com/advisories/gumbo-cms-sql-injection-via-settings-endpoint

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner