CVE-2020-36136

Summary

CVE-2020-36136 is a newly disclosed SQL Injection vulnerability impacting version 1.2.9 of the cszcms software developed by cskaza. This issue resides in the pm_sendmail parameter of the csz_model.php file, enabling unauthorized users to inject malicious SQL queries. Successful exploitation of this flaw allows attackers to access sensitive information stored in the affected database. This vulnerability poses a significant security risk and requires immediate attention from users running the affected software to apply available patches or upgrades.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.