Paper/Archive/CVE-2023-49688

CVE-2023-49688

Kashipara Group Job Portal — Job Portal v1.0 - Multiple Unauthenticated SQL Injections (SQLi)

CVSS 9.8 (CNA)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 52.1.521 × 2010.4 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'txtUser' parameter of the login.php resource does not validate the characters received and they are sent unfiltered to the database.

Affected

ProductAffectedFixed inSource

Job Portal1.0–CNA

Scores by source

Fluid Attacks (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

writeupfluidattacks.com/advisories/pollini refkashipara.com