Qianfox FoxCMS SQL Injection Vulnerability in Video Controller

A critical SQL injection vulnerability has been identified in Qianfox FoxCMS versions through 1.2.5. The issue arises in the 'batchCope' function within 'app/admin/controller/Video.php', where improper handling of the 'ids' argument allows for SQL injection. This vulnerability can be exploited remotely, and a public exploit is available.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can manipulate SQL queries to the database. This could lead to unauthorized data access, data manipulation, or in some cases, executing administrative operations on the database.

Reproduction

To reproduce this vulnerability, send a request to the 'batchCope' function in the 'Video' controller with a crafted 'ids' argument that exploits the SQL injection flaw. This can be done remotely.