HTB23132: ImageCMS SQL injection vulnerability

ImageCMS version 4.0.0b is vulnerable to perform SQL injection attacks. The vulnerability exists due to insufficient filtration of the "q" HTTP GET parameter passed to "/admin/admin_search/" URL. A remote authenticated administrator can execute arbitrary SQL commands in the application's database. Also this vulnerability can be exploited by remote non-authenticated attacker via CSRF vector because the application is prone to Cross-Site Request Forgery attack.

To stay secure from this vulnerability upgrade ImageCMS to 4.2 version.

Source: High-Tech Bridge Advisory HTB23132 - SQL Injection Vulnerability in ImageCMS.