CVE-2022-23358: EasyCMS v1.6 allows for SQL injection via ArticlemAction.class.php

This week

CRITICAL 9.8REMOTEDOWNGRADE

CVE-2022-23358 is a critical-severity flaw (CVSS 9.8) affecting easycms. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

EasyCMS v1.6 allows for SQL injection via ArticlemAction.class.php. In the background, search terms provided by the user were not sanitized and were used directly to construct a SQL statement.

Why this priority

Critical severity
Public exploit reference
Remotely exploitable, no login, no user action

No fix is published yet: follow the downgrade or mitigation steps.

Risk facts

CVSS score	9.8 (Critical)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	1.2% (top 32%)
CISA exploited list	No
Weakness	CWE-89
Published	2022-02-16
Last modified	2026-06-17

Publisher (CNA): MITRE · Vendor: easycms

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2022-02-16 12:15 UTCPublished CVE record published
2026-06-17 04:29 UTCUpdated Record last modified

easycms easycms DOWNGRADE

Affected: 1.6

Fixed in: no fixed release known

Safe to downgrade to: a release before 1.6

1. Check installed version

apt-cache policy easycms || rpm -q easycms || easycms --version

2. No fixed release: DOWNGRADE to a release before 1.6 (Debian / Ubuntu)

apt-cache madison easycms sudo apt install easycms=<VERSION_BEFORE_1.6> sudo apt-mark hold easycms

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list easycms sudo dnf downgrade easycms-<VERSION_BEFORE_1.6> sudo dnf versionlock add easycms

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2022-23358?

easycms: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2022-23358 being exploited?

CVE-2022-23358 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2022-23358 affect?

CVE-2022-23358 affects easycms. Severity is critical (CVSS 9.8). EasyCMS v1.6 allows for SQL injection via ArticlemAction.class.php. In the background, search terms provided by the user were not sanitized and were used directly to construct a SQL statement.

How urgent is CVE-2022-23358?

Priority 61/100. Critical severity; Public exploit reference; Remotely exploitable, no login, no user action

Software pages

PHP vulnerabilities

Related CVEs

CVE-2026-3786 MEDIUM 6.3 UPGRADE A security flaw has been discovered in EasyCMS up to 1.6
CVE-2026-3785 MEDIUM 6.3 UPGRADE A vulnerability was identified in EasyCMS up to 1.6
CVE-2026-1105 HIGH 7.3 UPGRADE A vulnerability was identified in EasyCMS up to 1.6
CVE-2020-24271 HIGH 8.8 DOWNGRADE A CSRF vulnerability was discovered in EasyCMS v1.6 that can add an admin account through index.php?s=/admin/r
CVE-2019-6294 HIGH 8.8 DOWNGRADE An issue was discovered in EasyCMS 1.5

References

← Back to latest CVEs