CVE-2023-24220: Improper Neutralization of Special Elements used in an SQL Command

LuckyframeWEB v3.5 was discovered to contain a SQL injection vulnerability via the dataScope parameter at /system/RoleMapper.xml...

CVE-2023-24219

CVE-2023-24219 affects LuckyframeWEB v3.5. The vulnerability is a SQL injection in the dataScope parameter of /system/UserMapper.xml. The root cause, as described in the sources, is improper handling/use of user-supplied data in dataScope, leading to high-severity impact (CVE metrics show Confide...

CVE-2023-24220

LuckyframeWEB v3.5 contains a SQL injection vulnerability in the dataScope parameter handled at /system/RoleMapper.xml. The issue, confirmed in multiple sources, yields a high-impact risk (CVE-2023-24220) with CVSS v3.1 base score 9.8 (CRITICAL) and network attack vector requiring no privileges o...

CVE-2023-24219

LuckyframeWEB v3.5 was discovered to contain a SQL injection vulnerability via the dataScope parameter at /system/UserMapper.xml...

CVE-2023-24219

LuckyframeWEB v3.5 was discovered to contain a SQL injection vulnerability via the dataScope parameter at /system/UserMapper.xml...

CVE-2023-24220

LuckyframeWEB v3.5 was discovered to contain a SQL injection vulnerability via the dataScope parameter at /system/RoleMapper.xml...

CVE-2023-24221

LuckyframeWEB v3.5 was discovered to contain a SQL injection vulnerability via the dataScope parameter at /system/DeptMapper.xml...

PT-2023-19483

Name of the Vulnerable Software and Affected Versions LuckyframeWEB version 3.5 Description A SQL injection issue was found in LuckyframeWEB via the dataScope parameter at the "/system/UserMapper.xml" API endpoint. This allows for potential exploitation. Recommendations For LuckyframeWEB version...

CVE-2023-24219: Improper Neutralization of Special Elements used in an SQL Command

LuckyframeWEB v3.5 was discovered to contain a SQL injection vulnerability via the dataScope parameter at /system/UserMapper.xml...