Lucene search

Fluid AttacksVULNRICHMENT:CVE-2023-46677

HistoryNov 07, 2023 - 8:35 p.m.

CVE-2023-46677 Online Job Portal v1.0 - Multiple Unauthenticated SQL Injections (SQLi)

2023-11-0720:35:03

CWE-89

Fluid Attacks

github.com

online job portal

sql injection

vulnerabilities

unauthenticated

sign-up.php

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.2

Confidence

Low

SSVC

Exploitation

none

Automatable

yes

Technical Impact

total

JSON

Online Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ‘txt_uname’ parameter of the sign-up.php resource does not validate the characters received and they are sent unfiltered to the database.

References

fluidattacks.com/advisories/netrebko

projectworlds.in

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.2

Confidence

Low

SSVC

Exploitation

none

Automatable

yes

Technical Impact

total

JSON

Related for VULNRICHMENT:CVE-2023-46677