CVE-2023-48901

2024-03-2104:15:08

[email protected]

web.nvd.nist.gov

sql injection

vulnerability

autoexpress

remote attackers

execute arbitrary commands

getphotosbycarid function

8.4 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.0%

JSON

A SQL injection vulnerability in tramyardg Autoexpress version 1.3.0, allows remote unauthenticated attackers to execute arbitrary SQL commands via the parameter “id” within the getPhotosByCarId function call in details.php.

References

packetstormsecurity.com/files/177660/Tramyardg-Autoexpress-1.3.0-SQL-Injection.html