Description (CNA)
Mailtrain through 1.24.1 allows SQL Injection in statsClickedSubscribersByColumn in lib/models/campaigns.js via /campaigns/clicked/ajax because variable column names are not properly escaped.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| n/a / n/a | affected n/a |
CWE
No CWE identifiers supplied.
References
- https://github.com/Mailtrain-org/mailtrain/pull/909
- https://securitylab.github.com/advisories/GHSL-2020-132-Mailtrain
ADP enrichment
No English description supplied.