Craft CMS SQL Injection Vulnerability via GraphQL API Endpoint
Summary
CVE-2024-37843: Craft CMS SQL injection vulnerability via the GraphQL API endpoint. Affects craftcms/cms versions < 3.7.31. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Craft CMS is an open-source content management system that allows users to create and manage websites. It provides a flexible and customizable platform for developers and content creators. Craft CMS up to version 3.7.31 is affected by a SQL injection vulnerability that can be exploited through the GraphQL API endpoint.
Vulnerability Detail
The SQL injection vulnerability in Craft CMS allows an attacker to manipulate database queries through the GraphQL API endpoint. By injecting malicious SQL code, an attacker can bypass security measures and gain unauthorized access to sensitive data or perform unauthorized actions on the affected system. This vulnerability has a critical severity rating with a CVSS score of 9.8. It can lead to data breaches, unauthorized data modification, or even complete system compromise.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If upgrading to the latest version is not immediately possible, a temporary workaround is to disable or restrict access to the GraphQL API endpoint. This can be done by modifying the server configuration or using access control mechanisms to block unauthorized requests to the vulnerable endpoint.
Conclusion
Craft CMS up to version 3.7.31 is affected by a critical SQL injection vulnerability via the GraphQL API endpoint. This vulnerability can be exploited to manipulate database queries and gain unauthorized access to sensitive data. It is crucial to upgrade to Craft CMS version 3.7.32 or later to mitigate this vulnerability. If immediate upgrade is not possible, restricting access to the GraphQL API endpoint can serve as a temporary workaround.
See every vulnerability recorded for craftcms/cms →
FAQ
Craft CMS is an open-source content management system used for building and managing websites.
A SQL injection vulnerability is a security flaw that allows an attacker to manipulate database queries by injecting malicious SQL code.
The Craft CMS SQL injection vulnerability can be exploited by sending specially crafted requests to the GraphQL API endpoint, injecting malicious SQL code.
The potential consequences of this vulnerability include unauthorized access to sensitive data, data breaches, and unauthorized modification of data.
To fix the Craft CMS SQL injection vulnerability, it is recommended to upgrade to version 3.7.32 or later. Alternatively, you can temporarily disable or restrict access to the GraphQL API endpoint.
Related vulnerabilities
Recent vulnerabilities recorded for craftcms/cms.
