CVE-2022-38148
published 2022-11-21CVE-2022-38148: Silverstripe silverstripe/framework through 4.11 allows SQL Injection.
PriorityP349high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
0.72%
49.4th percentile
Silverstripe silverstripe/framework through 4.11 allows SQL Injection.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| silverstripe | framework | <= 4.11.0 | — |
| silverstripe | framework | >= 4.0.0 < 4.10.11 | 4.10.11 |
| silverstripe | framework | >= 4.11.0 < 4.11.14 | 4.11.14 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Blind SQL Injection via GridFieldSortableHeader
osv·2022-11-22
CVE-2022-38148 [HIGH] Blind SQL Injection via GridFieldSortableHeader
Blind SQL Injection via GridFieldSortableHeader
Gridfield state is vulnerable to SQL injections. The vast majority of Gridfields in Silverstripe CMS are affected by this vulnerability.
An attacker with CMS access could execute an arbitrary SQL statement by adding an SQL payload in some parts of the GridField state.
GHSA
Blind SQL Injection via GridFieldSortableHeader
ghsa·2022-11-22
CVE-2022-38148 [HIGH] CWE-89 Blind SQL Injection via GridFieldSortableHeader
Blind SQL Injection via GridFieldSortableHeader
Gridfield state is vulnerable to SQL injections. The vast majority of Gridfields in Silverstripe CMS are affected by this vulnerability.
An attacker with CMS access could execute an arbitrary SQL statement by adding an SQL payload in some parts of the GridField state.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://forum.silverstripe.org/c/releaseshttps://www.silverstripe.org/blog/tag/releasehttps://www.silverstripe.org/download/security-releases/https://www.silverstripe.org/download/security-releases/CVE-2022-38148https://forum.silverstripe.org/c/releaseshttps://www.silverstripe.org/blog/tag/releasehttps://www.silverstripe.org/download/security-releases/https://www.silverstripe.org/download/security-releases/CVE-2022-38148
2022-11-21
Published