Threats tagged 'ghsa-w2f7-mc8w-f637'

Craft CMS versions 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contain a blind SQL injection vulnerability. This occurs because the getNext() and getPrev() methods expose sandboxed template functionality that improperly passes arbitrary criteria arrays to Craft::configure() without filtering out SQL-related properties like orderBy and where. Authenticated control panel users can exploit this by supplying crafted elementIds values to execute conditional SQL queries under the Craft database account.