Non évaluée
An issue was discovered in Form Tools through 3.0.20. SQL Injection can occur via the export_group_id field when a low-privileged user (client) tries...
CVE-2021-38145
Première détection SecPulse
Description d'origine La description telle que publiée par la source (souvent en anglais).
An issue was discovered in Form Tools through 3.0.20. SQL Injection can occur via the export_group_id field when a low-privileged user (client) tries to export a form with data, e.g., manipulation of modules/export_manager/export.php?export_group_id=1&export_group_1_results=all&export_type_id=1.
Références
- advisory github.com
- advisory formtools.org
- report bernardofsr.github.io
- report github.com