| Package | Affected versions | Patched versions |
|---|---|---|
| b2evolution | = 4.1.0= 4.1.1= 4.1.2= 4.1.3= 4.1.4= 4.1.5≤ 4.1.6 |
SQL injection vulnerability in blogs/admin.php in b2evolution before 4.1.7 allows remote authenticated administrators to execute arbitrary SQL commands via the show_statuses[] parameter. NOTE: this can be leveraged using CSRF to allow remote unauthenticated attackers to execute arbitrary SQL commands.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free