CVE-2024-31212

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-31212
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-31212.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-31212
Aliases
  • GHSA-qx95-w566-73fw
Published
2024-04-04T23:02:38.775Z
Modified
2026-04-02T10:10:08.780586Z
Severity
  • 6.7 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L CVSS Calculator
Summary
SQL injection in index_chart_data action
Details

InstantCMS is a free and open source content management system. A SQL injection vulnerability affects instantcms v2.16.2 in which an attacker with administrative privileges can cause the application to execute unauthorized SQL code. The vulnerability exists in indexchartdata action, which receives an input from user and passes it unsanitized to the core model filterFunc function that further embeds this data in an SQL statement. This allows attackers to inject unwanted SQL code into the statement. The period should be escaped before inserting it in the query. As of time of publication, a patched version is not available.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/31xxx/CVE-2024-31212.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-20",
        "CWE-89"
    ]
}
References

Affected packages

Git / github.com/instantsoft/icms2

Affected ranges

Type
GIT
Repo
https://github.com/instantsoft/icms2
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
c710ff6c753ae9d726c4c2bbdd8440fed834c6a7
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "= 2.16.2"
        }
    ]
}

Affected versions

2.*
2.10.0
2.10.1
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
2.14.0
2.14.1
2.14.2
2.14.3
2.15.0
2.15.1
2.15.2
2.16.0
2.16.1
2.16.2
2.3.0
2.4.0
2.5.0
2.5.1
2.6.0
2.6.1
2.7.0
2.7.1
2.7.2
2.8.0
2.8.1
2.8.2
2.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-31212.json"