CMS Made Simple <=2.2.15 is affected by SQL injection in modules/News/function.admin_articlestab.php. The $sortby variable is concatenated with $query1, but it is possible to inject arbitrary SQL language without using the '.
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
| Link | Tags |
|---|---|
| https://seclists.org/fulldisclosure/2021/Mar/49 | mailing list exploit third party advisory |
| https://github.com/beerpwn/CVE/blob/master/cms_made_simple_2021/sqli_order_by/CMS-MS-SQLi-report.md | third party advisory exploit |
| https://packetstormsecurity.com/files/161895/CMS-Made-Simple-2.2.15-SQL-Injection.html | exploit vdb entry third party advisory |
| https://www.soteritsecurity.com/blog/2023/01/CMS-Made-Simple_CVE-2021-40961.html |