PT-2023-20035 · Unknown · Faveo Helpdesk

Ghost · Publicado 2023-03-24 · Atualizado 2025-02-21 · CVE-2023-25350

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Faveo Helpdesk versions 1.0 through 1.11.1

Description The issue arises from a lack of validation on user input data during the login process. This allows parameters passed from the front end to the back end to be controlled, leading to SQL injection.

Recommendations For Faveo Helpdesk versions 1.0 through 1.11.1, consider validating user input data to prevent SQL injection attacks. As a temporary workaround, restrict access to sensitive database operations until a proper fix is applied.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2023-25350

Produtos afetados

Faveo Helpdesk

Referências · 5

• 🔥 https://github.com/ladybirdweb/faveo-helpdesk/issues/7827 · Exploit
• https://t.me/cvenotify/112074 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-25350 · Aviso do Fabricante
• https://gist.github.com/Whitehat-Su/8402323c00ea93b4abc21ab9a372101e · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-25350 · Nota de Segurança