What’s Vulnerable › Vulnerabilities

CVE-2024-58307: CSZCMS 1.3.0 Authenticated SQL Injection via Members View Endpoint

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-12-11 · updated 2026-10-27
• Weakness: CWE-89

Description

CSZCMS 1.3.0 contains an authenticated SQL injection vulnerability in the members view functionality that allows authenticated attackers to manipulate database queries. Attackers can inject malicious SQL code through the view parameter to potentially execute time-based blind SQL injection attacks and extract database information.

Affected products

• Cszcms CSZ CMS: 1.3.0

References

• https://sourceforge.net/projects/cszcms/files/install/CSZCMS-V1.3.0.zip/download
• https://www.cszcms.com/
• https://www.exploit-db.com/exploits/51916
• https://www.vulncheck.com/advisories/cszcms-authenticated-sql-injection-via-members-view-endpoint

Get alerted when CVE-2024-58307 or the next vulnerability affects your stack