Paper/Archive/CVE-2023-46679

CVE-2023-46679

Projectworlds Pvt. Limited Online Job Portal — Online Job Portal v1.0 - Multiple Unauthenticated SQL Injections (SQLi)

CVSS 9.8 (CNA)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 57.6.576 × 2011.5 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Online Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'txt_uname_email' parameter of the index.php resource does not validate the characters received and they are sent unfiltered to the database.

Affected

ProductAffectedFixed inSource

Online Job Portal1.0–CNA

Scores by source

Fluid Attacks (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

writeupfluidattacks.com/advisories/netrebko refprojectworlds.in