CVE-2018-17796

CRITICAL 9.8CVE-2018-17796 · Published 30/09/2018 · updated 17/06/2026

In short

CVE-2018-17796 is a CRITICAL (CVSS 9.8) vulnerability affecting mushroom content management system (mushroom content management system project).
Chance of exploitation in the next 30 days (EPSS): 1.5%, higher than 75.0% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
mushroom content management system mushroom_content_management_system_project	`≤ 3.1.2`	No fix yet

Description

An issue was discovered in MRCMS (aka mushroom) through 3.1.2. The WebParam.java file directly accepts the FIELD_T parameter in a request and uses it as a hash of SQL statements without filtering, resulting in a SQL injection vulnerability in getChannel() in the ChannelService.java file.

References

wuweiit/mushroom · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free