Sql injection

2023-01-0303:15:00

PRIOn knowledge base

www.prio-n.com

sql injection

easytest

input validation

remote attacker

database access

8.9 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

54.1%

JSON

The Download function’s parameter of EasyTest has insufficient validation for user input. A remote attacker authenticated as a general user can inject arbitrary SQL command to access, modify or delete database.

CPENameOperatorVersion
easy_testeq17.0.0-l18-s

CPE	Name	Operator	Version
	easy_test	eq	17.0.0-l18-s

References

www.twcert.org.tw/tw/cp-132-6829-11133-1.html