CVE-2021-22847 HIGH

CVE-2021-22847: Hyweb HyCMS-J1 - SQL Injection

Vendor Hyweb
Product HyCMS-J1
Weakness CWE-89 · SQLi
Published January 22, 2021
Last update September 16, 2024
View on NVD All CVEs

CVSS base score

8.8/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Hyweb HyCMS-J1's API fail to filter POST request parameters. Remote attackers can inject SQL syntax and execute commands without privilege.

Key dates

02Disclosure timeline

January 22, 2021 CVE published
September 16, 2024 Record updated