HIGH8.8

GHSA-phhm-6pgm-mxw9

MODX Revolution blind SQL injection

Quick fix

GHSA-phhm-6pgm-mxw9 — modx/revolution: upgrade to the fixed version with the command below.

composer require modx/revolution:^2.6.0

Details

MODX Revolution version 2.x - 2.5.6 is vulnerable to blind SQL injection caused by improper sanitization by the escape method resulting in authenticated user accessing database and possibly escalating privileges.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/modx/revolution

Introduced in: 2.0.0Fixed in: 2.6.0

Fixcomposer require modx/revolution:^2.6.0

References

https://nvd.nist.gov/vuln/detail/CVE-2017-1000067[ADVISORY]
https://github.com/modxcms/revolution[PACKAGE]
https://github.com/modxcms/revolution/blob/2.x/core/xpdo/changelog.txt#L48[WEB]
https://github.com/modxcms/revolution/blob/9bf1c6cf7bdc12190b404f93ce7798b39c07bc59/core/xpdo/changelog.txt[WEB]