CVE-2024-58307

CSZCMS 1.3.0 contains an authenticated SQL injection vulnerability in the members view functionality that allows authenticated attackers to manipulate database queries. Attackers can inject malicious SQL code through the view parameter to potentially execute time-based blind SQL injection attacks and extract database information.

Score

CVSS 4.0 9.3 Critical

Status

Analyzed - disclosure@vulncheck.com

Published

2025-12-11

Last modified

2026-10-27

Weaknesses

CWE-89

Affected products

• Csz Cms (Cszcms)

References

• https://www.exploit-db.com/exploits/51916
• https://www.cszcms.com/
• https://sourceforge.net/projects/cszcms/files/install/CSZCMS-V1.3.0.zip/download
• https://www.vulncheck.com/advisories/cszcms-authenticated-sql-injection-via-members-view-endpoint