CVE-2024-31212

CVE-2024-31212 is a medium-severity vulnerability in Instantcms with a CVSS 3.x base score of 6.7. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-89.

Key facts

Description

InstantCMS is a free and open source content management system. A SQL injection vulnerability affects instantcms v2.16.2 in which an attacker with administrative privileges can cause the application to execute unauthorized SQL code. The vulnerability exists in index_chart_data action, which receives an input from user and passes it unsanitized to the core model `filterFunc` function that further embeds this data in an SQL statement. This allows attackers to inject unwanted SQL code into the statement. The `period` should be escaped before inserting it in the query. As of time of publication, a patched version is not available.

Frequently asked questions

What is CVE-2024-31212?
InstantCMS is a free and open source content management system. A SQL injection vulnerability affects instantcms v2.16.2 in which an attacker with administrative privileges can cause the application to execute unauthorized SQL code. The vulnerability exists in index_chart_data action, which receives an input from user and passes it unsanitized to the core model `filterFunc` function that further embeds this data in an SQL statement. This allows attackers to inject unwanted SQL code into the statement. The `period` should be escaped before inserting it in the query. As of time of publication, a patched version is not available.
How severe is CVE-2024-31212?
CVE-2024-31212 has a CVSS 3.x base score of 6.7, rated medium severity. It is exploitable over network with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability low.
Is CVE-2024-31212 being actively exploited?
It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (57th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-31212?
CVE-2024-31212 affects Instantcms. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2024-31212?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2024-31212 have an EU (EUVD) identifier?
Yes. CVE-2024-31212 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-29112.
When was CVE-2024-31212 published?
CVE-2024-31212 was published on 2024-04-04 and last updated on 2026-06-17.

References

Affected products (1)

More vulnerabilities in Instantcms

All CVEs affecting Instantcms →

Other CWE-89 (SQL Injection) vulnerabilities

Browse all CWE-89 (SQL Injection) vulnerabilities →