Dismissed
Permalink
CVE-2023-53982
8.2 HIGH
- CVSS version: 3.1
- Attack vector (AV): NETWORK
- Attack complexity (AC): LOW
- Privileges required (PR): NONE
- User interaction (UI): NONE
- Scope (S): UNCHANGED
- Confidentiality impact (C): HIGH
- Integrity impact (I): LOW
- Availability impact (A): NONE
by @LeSuisse Activity log
- Created automatic suggestion
- @LeSuisse removed package pmbootstrap
- @LeSuisse dismissed
PMB 7.4.6 SQL Injection Vulnerability via Unsanitized Storage Parameter
PMB 7.4.6 contains a SQL injection vulnerability in the storage parameter of the ajax.php endpoint that allows remote attackers to manipulate database queries. Attackers can exploit the unsanitized 'id' parameter by injecting conditional sleep statements to extract information or perform time-based blind SQL injection attacks.
References
- ExploitDB-51197 exploit
- Vendor Homepage product
- Software Download Repository product
- VulnCheck Advisory: PMB 7.4.6 SQL Injection Vulnerability via Unsanitized Storage Parameter third-party-advisory
- ExploitDB-51197 exploit
- Vendor Homepage product
- Software Download Repository product
- VulnCheck Advisory: PMB 7.4.6 SQL Injection Vulnerability via Unsanitized Storage Parameter third-party-advisory
Affected products
PMB
- ==7.4.6