A ready-made attack for a flaw in Mingsoft MCMS is now public
KROMSE explanation
Mingsoft MCMS has a security flaw (CVE-2022-30047). The official record says: Mingsoft MCMS v5.2.7 was discovered to contain a SQL injection vulnerability in /mdiy/dict/listExcludeApp URI via orderBy parameter.
Not confirmed yet, but attack code is public, so attacks often follow within days.
Anyone running Mingsoft MCMS.
- Install the maker's update for Mingsoft MCMS as soon as it is out.
- Not sure if you use it? KROMSE can check your product for free.
