PT-2023-22634 · Unknown · Chatengine
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
ChatEngine version 1.0
Description
The issue allows attackers to gain sensitive information through a SQL Injection vulnerability in the
textMessage parameter in the /src/chatbotapp/chatWindow.java file.Recommendations
For ChatEngine version 1.0, consider restricting access to the
textMessage parameter in the /src/chatbotapp/chatWindow.java file to minimize the risk of exploitation. As a temporary workaround, avoid using the textMessage parameter in the affected API endpoint until the issue is resolved.Fix
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Chatengine