PT-2023-22634 · Unknown · Chatengine

Akshat Singhal · Publicado 2023-07-06 · Atualizado 2023-07-12 · CVE-2023-30325

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ChatEngine version 1.0

Description The issue allows attackers to gain sensitive information through a SQL Injection vulnerability in the textMessage parameter in the /src/chatbotapp/chatWindow.java file.

Recommendations For ChatEngine version 1.0, consider restricting access to the textMessage parameter in the /src/chatbotapp/chatWindow.java file to minimize the risk of exploitation. As a temporary workaround, avoid using the textMessage parameter in the affected API endpoint until the issue is resolved.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2023-30325

Produtos afetados

Chatengine

Referências · 4

• https://github.com/wliang6/ChatEngine/blob/fded8e710ad59f816867ad47d7fc4862f6502f3e/src/chatbotapp/chatWindow.java#L33:L60 · Nota
• https://osv.dev/vulnerability/CVE-2023-30325 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-30325 · Nota de Segurança
• https://payatu.com/advisory/sql-injection-vulnerability-in-textmessage-field-in-chatengine-1-0 · Nota