CVE-2023-7145

gopeak MasterLab versions up to 3.3.10 contain a SQL injection in the HTTP POST Request Handler, specifically in the sqlInject function of app/ctrl/Framework.php where tampering the pwd parameter enables injection. Confirmed details show exploitation has been disclosed. Practical impact is high: ...

CVE-2023-7145 gopeak MasterLab HTTP POST Request Framework.php sqlInject sql injection

A vulnerability classified as critical was found in gopeak MasterLab up to 3.3.10. This vulnerability affects the function sqlInject of the file app/ctrl/Framework.php of the component HTTP POST Request Handler. The manipulation of the argument pwd leads to sql injection. The exploit has been...