CVE-2023-38844

2024-02-2100:00:00

mitre

github.com

sql injection

pmb v.7.4.7

remote attacker

arbitrary code

thesaurus parameter

AI Score

8.6

Confidence

Low

SSVC

Exploitation

none

Automatable

yes

Technical Impact

partial

JSON

SQL injection vulnerability in PMB v.7.4.7 and earlier allows a remote attacker to execute arbitrary code via the thesaurus parameter in export_skos.php.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:pmb_project:pmb:7.4.7:*:*:*:*:*:*:*"
    ],
    "vendor": "pmb_project",
    "product": "pmb",
    "versions": [
      {
        "status": "affected",
        "version": "7.4.7"
      }
    ],
    "defaultStatus": "unknown"
  }
]