Medium severity · published Aug 29, 2024
CVE-2024-8303
dingfanzu CMS getBasicInfo.php sql injection
6.3
CVSS
0.4%
EPSS
No
On KEV
Description
A vulnerability classified as critical has been found in dingfanzu CMS up to 29d67d9044f6f93378e6eb6ff92272217ff7225c. This affects an unknown part of the file /ajax/getBasicInfo.php. The manipulation of the argument username leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CM
CMS · dingfanzu
29d67d9044f6f93378e6eb6ff92272217ff7225c · source: vendor, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-8303
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-8303
github.com
https://github.com/Xor-Gerke/webray.com.cn/blob/main/cve/dingfanzu-CMS/dingfanzu-CMS%20getBasicInfo.php%20username%20SQL-inject.md
vuldb.com
https://vuldb.com/?ctiid.276075
vuldb.com
https://vuldb.com/?id.276075
vuldb.com
https://vuldb.com/?submit.396298
More from CMS
9.8
CVE-2024-8302
dingfanzu CMS chpwd.php sql injection
9.8
CVE-2024-8301
dingfanzu CMS checkin.php sql injection
9.3
CVE-2024-50966
dingfanzu CMS V1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/doAdminAction.php?act=addAdmin
6.3
CVE-2025-1544
dingfanzu CMS loadShopInfo.php sql injection
6.3
CVE-2024-9294
dingfanzu CMS saveNewPwd.php sql injection