Vulnerability · Published Dec 11, 2025 · Assigned by VulnCheck
CVE-2024-58307CSZCMS 1.3.0 Authenticated SQL Injection via Members View Endpoint
Critical 9.3
In plain English
A critical-severity SQL injection in CSZCMS from cszcms. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).
Severity (CVSS 4.0)9.3Critical
Exploit odds (30 days)0.5%top 56.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
CSZCMS 1.3.0 contains an authenticated SQL injection vulnerability in the members view functionality that allows authenticated attackers to manipulate database queries. Attackers can inject malicious SQL code through the view parameter to potentially execute time-based blind SQL injection attacks and extract database information.
Affected products (as reported)
Weakness: CWE-89 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
References
- ExploitDB-51916 exploit
- CSZCMS Homepage product
- CSZCMS Download Page product
- VulnCheck Advisory: CSZCMS 1.3.0 Authenticated SQL Injection via Members View Endpoint third-party-advisory