by Kastro
Paper/Archive/CVE-2023-26572

CVE-2023-26572

IDAttend Pty Ltd IDWeb — Unauthenticated SQL Injection In IDAttend’s IDWeb Application

EPSS 0.9%CVSS 9.8
critical.is priorityof 100
42
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 61.1.611 × 2012.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Unauthenticated SQL injection in the GetExcursionList method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of all data by unauthenticated attackers.

Affected

ProductAffectedFixed inSource
IDWeb≤ 3.1.052–CNA

Scores by source

TML (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refthemissinglink.com.au/security-advisories/cve-2023-26572