Description
The endpoint /site-structure/localizer/save-string/:lang/:defstring accepts two parameter values: lang and defstring. These values are used in an unsafe way to set the keys and value of the cfgStrings object.
Recommendation
Update the @saltcorn/server package to the latest compatible version. Followings are version details:
- Affected version(s): <= 1.0.0-beta.13
- Patched version(s): 1.0.0-beta.14
References
Could your website be exposed too?
SmartScanner can check your website for @saltcorn/server Remote Code Execution (RCE) / SQL injection via prototype pollution by manipulating `lang` and `defst and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Renderer - Vulnerability
- @saltcorn/plugins-loader unsanitized plugin name leads to a remote code execution (RCE) vulnerability when creating plug - Vulnerability
- @saltcorn/data vulnerable to SQL Injection via jsexprToSQL Literal Handler - Vulnerability
- DbGate: Remote Code Execution via functionName injection in loadReader endpoint - CVE-2026-48017
You might also like:
See something that needs correcting? Let us knowUpdated October 04, 2024