PT-2023-12327
CVE-2021-37522
·
تاريخ النشر
2023-07-18
·
تاريخ التحديث
2023-07-27
الوصف من
CVSS 3.1
9.8
حرجةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
HKing2802 Locke-Bot version 2.0.2
Description
The issue allows remote attackers to execute arbitrary SQL commands by sending a crafted string to specific API endpoints, including /src/db.js, /commands/mute.js, and /modules/event/messageDelete.js. This enables attackers to manipulate the database.
Recommendations
For HKing2802 Locke-Bot version 2.0.2, consider restricting access to the /src/db.js, /commands/mute.js, and /modules/event/messageDelete.js endpoints until a patch is available. As a temporary workaround, validate and sanitize all input strings to prevent SQL injection attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾