PT-2023-31297 · Unknown · Job Portal

·

CVE-2023-49688

·

Publicado

2023-12-21

·

Atualizado

2023-12-27

CVSS v3.1

9.8

Crítica

VetorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Job Portal version 1.0
Description The issue concerns multiple Unauthenticated SQL Injection vulnerabilities. The txtUser parameter of the "login.php" resource does not validate the characters received, and they are sent unfiltered to the database.
Recommendations For Job Portal version 1.0, as a temporary workaround, consider validating and filtering the input for the txtUser parameter in the "login.php" resource to prevent SQL injection attacks. Restrict access to the "login.php" resource until a proper fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾

Enumeração de Fraquezas

Identificadores relacionados

CVE-2023-49688

Produtos afetados

Job Portal