A SQL injection vulnerability exists in CSZ-CMS <=1.3.0 in the Form Builder view functionality. The vulnerability is located in the field parameter of the form viewing feature, allowing authenticated administrators to execute arbitrary SQL queries.
References
| Link | Resource |
|---|---|
| https://github.com/Huu1j/CSZ_CMS-exploit/blob/main/csz-cms-vulnerability-analysis.md | Exploit Third Party Advisory |
Configurations
History
22 Dec 2025, 15:17
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/Huu1j/CSZ_CMS-exploit/blob/main/csz-cms-vulnerability-analysis.md - Exploit, Third Party Advisory | |
| CPE | cpe:2.3:a:cszcms:csz_cms:*:*:*:*:*:*:*:* | |
| First Time |
Cszcms csz Cms
Cszcms |
24 Nov 2025, 21:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.4 |
30 Oct 2025, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
| CWE | CWE-89 |
30 Oct 2025, 13:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-10-30 13:15
Updated : 2025-12-22 15:17
NVD link : CVE-2025-63608
Mitre link : CVE-2025-63608
CVE.ORG link : CVE-2025-63608
JSON object : View
Products Affected
cszcms
- csz_cms
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')