Subrion CMS is vulnerable to SQL injection from authenticated users when a browser cookie is modified in a certain way.
Subrion is an open source web-based content management system (CMS). Subrion is vulnerable to SQL injection due to deserialization of untrusted data from a browser cookie.
CWE-502: Deserialization of Untrusted Data
An authenticated remote user may execute arbitrary SQL statements on Subrion's database.
Apply an update
Thanks to Jack Baker for reporting this vulnerability to us, and to Subrion for quickly addressing this issue.
This document was written by Garret Wassermann.
|Date First Published:||2015-05-08|
|Date Last Updated:||2015-05-08 14:44 UTC|