Date published: 2017-07-12T17:29:00.193-04:00
Date last modified: 2017-07-27T14:05:01.137-04:00
CVSS Score: 7.5
Principal attack vector: NETWORK
Reference URL: https://tsublogs.wordpress.com/2017/07/12/xoops-core-2-5-8-1-install-db-sql-injection/
Summary: In install/page_dbsettings.php in the Core distribution of XOOPS 18.104.22.168, unfiltered data passed to CREATE and ALTER SQL queries caused SQL Injection in the database settings page, related to use of GBK in CHARACTER SET and COLLATE clauses.