CVE-2018-9247 | BDVDB-2026-98922 Detail

Description#

The upsql function in \Lib\Lib\Action\Admin\DataAction.class.php in Gxlcms QY v1.0.0713 allows remote attackers to execute arbitrary SQL statements via the sql parameter. Consequently, an attacker can execute arbitrary PHP code by placing it after a <?php substring, and then using INTO OUTFILE with a .php filename.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

http://www.atksec.com/cve/GxlcmsQY-v1.0.0713-getshell/index.html

Exploit#

No public exploit known

History#

Version 12018-04-04Record published in the CVE List.
Version 22024-08-05Most recent update recorded in the CVE List.