Threats tagged 'ghsa-qvg8-69ff-cf67'

Craft CMS versions 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 are affected by an unauthenticated SQL injection vulnerability in the element search endpoint. This flaw arises because the attribute parameter is concatenated into the SQL query without proper sanitization, and the emulated PDO prepares allow stacked statements. Exploitation enables remote attackers to read and write the database, including setting the admin flag or overwriting password hashes to gain administrator access.