An issue was discovered in Waimai Super Cms 20150505. web/Lib/Action/PublicAction.class.php allows time-based SQL Injection via the param array parameter to the /index.php?m=public&a=checkemail URI.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7585
Reference (s):
- https://github.com/caokang/waimai/issues/11