Lucene search

Fluid AttacksCVELIST:CVE-2023-43013

HistorySep 28, 2023 - 9:00 p.m.

CVE-2023-43013 Asset Management System v1.0 - Unauthenticated SQL Injection (SQLi)

2023-09-2821:00:07

CWE-89

Fluid Attacks

www.cve.org

cve-2023-43013

asset management system

sql injection

unauthenticated

index.php

database dump

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

0.001

Percentile

37.1%

JSON

Asset Management System v1.0 is vulnerable to an

unauthenticated SQL Injection vulnerability on the

‘email’ parameter of index.php page, allowing an

external attacker to dump all the contents of the

database contents and bypass the login control.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Asset Management System",
    "vendor": "Asset Management System",
    "versions": [
      {
        "status": "affected",
        "version": "1.0"
      }
    ]
  }
]

References

fluidattacks.com/advisories/nergal

projectworlds.in/

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

0.001

Percentile

37.1%

JSON

Related for CVELIST:CVE-2023-43013