CVE-2023-48901

2024-03-2100:00:00

mitre

www.cve.org

vulnerability

sql injection

tramyardg autoexpress

remote attackers

arbitrary commands

8.7 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.0%

JSON

A SQL injection vulnerability in tramyardg Autoexpress version 1.3.0, allows remote unauthenticated attackers to execute arbitrary SQL commands via the parameter “id” within the getPhotosByCarId function call in details.php.

References

packetstormsecurity.com/files/177660/Tramyardg-Autoexpress-1.3.0-SQL-Injection.html