CVE-2019-19734

Published
View on NVD ↗
CVSS v3
8.8
HIGH
CVSS v2
6.5
MEDIUM
Affected
1
PROJECT

Description

_account_move_file_in_folder.ajax.php in MFScripts YetiShare 3.5.2 directly inserts values from the fileIds parameter into a SQL string. This allows an attacker to inject their own SQL and manipulate the query, typically extracting data from the database, aka SQL Injection.

jra89/CVE-2019-19734
jra89/CVE-2019-19734UNAVAILABLE
YetiShare SQL Injection in the fileIds parameter in _account_move_file_in_folder.ajax.php - v3.5.2
GitHubGitHub