CVE-2023-52285

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-52285
ExamSys 9150244 allows SQL Injection via the /Support/action/Pages.php s_score2 parameter.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://fh4ntke.medium.com/examsys-multiple-sql-injections-ef94d84e440c Exploit Third Party Advisory
https://github.com/lrx0014/ExamSys/commit/915024448428867f2228cf7f06abd1b6e65e9397 Patch
Configurations

Configuration 1 (hide)

cpe:2.3:a:lrx0014:examsys:9150244:*:*:*:*:*:*:*
History

24 Jan 2024, 17:16

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
References () https://fh4ntke.medium.com/examsys-multiple-sql-injections-ef94d84e440c - () https://fh4ntke.medium.com/examsys-multiple-sql-injections-ef94d84e440c - Exploit, Third Party Advisory
References () https://github.com/lrx0014/ExamSys/commit/915024448428867f2228cf7f06abd1b6e65e9397 - () https://github.com/lrx0014/ExamSys/commit/915024448428867f2228cf7f06abd1b6e65e9397 - Patch
CWE CWE-89
First Time Lrx0014 examsys
Lrx0014
CPE cpe:2.3:a:lrx0014:examsys:9150244:*:*:*:*:*:*:*

17 Jan 2024, 14:01

Type Values Removed Values Added
New CVE
Information

Published : 2024-01-17 08:15

Updated : 2024-01-24 17:16

NVD link : CVE-2023-52285

Mitre link : CVE-2023-52285

CVE.ORG link : CVE-2023-52285

JSON object : View

Products Affected

lrx0014

  • examsys
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')