CVE-2020-21808

Vulnerability

A SQL injection vulnerability exists in NukeViet CMS versions 4.0.10 through 4.3.07. The flaw is located in the file modules/news/admin/addtotopics.php, where the topicsid parameter is not properly sanitized before being used in SQL queries [1][4]. This allows an attacker to inject malicious SQL code.

Exploitation

To exploit this vulnerability, an attacker must have administrator-level access to the news module [4]. The attacker can manipulate the topicsid parameter in a request to addtotopics.php, injecting arbitrary SQL statements [1]. No user interaction other than the administrator performing a legitimate action is required.

Impact

Successful exploitation allows an attacker to execute arbitrary SQL commands against the underlying database. This can lead to unauthorized disclosure, modification, or deletion of sensitive data, potentially compromising the entire CMS installation [1]. The impact is limited to the privileges of the database user, which typically has full access.

Mitigation

The vulnerability is fixed in NukeViet CMS version 4.3.08, as noted in the changelog [3]. For earlier versions (4.0, 4.1, 4.2), specific patches are available from the vendor's website [4]. Administrators are strongly advised to update to the latest version or apply the appropriate patch for their release.