A problematic code pattern was found in ~8 places. Any of these places could be vulnerable a SQL injection (SQLI) attack. However, it is believed that most or all have mitigating factors that prevent exploits.
Users with access APIv3 or APIv4 via any medium (including web-browser) may be able to execute an SQL injection (SQL) attack.
KCFinder provides a file-management dialog for CKEditor 4. It included two vulnerabilities:
Template authors can perform remote code execution (RCE) with a specially crafted call to the {math} function.
(This issue was identified as part of a general audit of Smarty v2, CIVI-PSA-2023-01.)
Recent version of CiviCRM with the The Island theme on WordPress. Minimal read-only demo.
To login: username is "demo" and password is "demo123".
We provide turn-key CiviCRM hosting (no installation costs, regular CiviCRM upgrades, backups, secure https, 24/7 monitoring, no lock-in) with Drupal7, Drupal8 and WordPress, in French, English or bilingual configurations.
