CVE-2024-58307

critical · 9.3

CSZCMS 1.3.0 contains an authenticated SQL injection vulnerability in the members view functionality that allows authenticated attackers to manipulate database queries. Attackers can inject malicious SQL code through the view parameter to potentially execute time-based blind SQL injection attacks and extract database information.

9.3

CVSS

0.5%

EPSS (exploit prob.)

43rd

EPSS percentile

2025-12-11

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-89

Affected products

Vendor	Product	Affected versions
cszcms	csz_cms	1.3.0

Check a specific version with /api/v1/cve/match.

References

https://sourceforge.net/projects/cszcms/files/install/CSZCMS-V1.3.0.zip/download
https://www.cszcms.com/
https://www.exploit-db.com/exploits/51916
https://www.vulncheck.com/advisories/cszcms-authenticated-sql-injection-via-members-view-endpoint

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2024-58307