PT-2023-22633 · Unknown · Payatu Chatengine

Akshat Singhal · Publicado 2023-07-06 · Atualizado 2023-07-12 · CVE-2023-30323

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Payatu ChatEngine version 1.0

Description The issue allows attackers to gain sensitive information through a SQL Injection vulnerability in the username field, located in the /src/chatbotapp/chatWindow.java file.

Recommendations For Payatu ChatEngine version 1.0, consider restricting access to the chatWindow.java file or disabling the username field until a patch is available. Avoid using the username field in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2023-30323

Produtos afetados

Payatu Chatengine

Referências · 5

• https://github.com/wliang6/ChatEngine/blob/fded8e710ad59f816867ad47d7fc4862f6502f3e/src/chatbotapp/chatWindow.java#L34:L60 · Nota
• https://osv.dev/vulnerability/CVE-2023-30323 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-30323 · Nota de Segurança
• https://payatu.com/advisory/sql-injection-in-chatwindow-functionality-in-chatengine-1-0 · Nota
• https://t.me/cibsecurity/66122 · Publicação no Telegram