CVE-2018-18242

youke365 v1.1.5 has SQL injection via admin/login.html, as demonstrated by username=admin&pass=123456&code=9823&act=login&submit=%E7%99%BB+%E9%99%86.

Score

CVSS 3.0 9.8 Critical

Status

Modified - cve@mitre.org

Published

2018-10-11

Last modified

2024-08-05

Weaknesses

CWE-89

Affected products

• Youke 365 (Youke365)

References

• https://github.com/yanchongchong/swallow/issues/4