PT-2023-25704 · Picodb+1 · Picodb+1
Riccardobonafede
·
Publicado
2023-07-05
·
Atualizado
2025-04-10
·
CVE-2023-36813
CVSS v3.1
7.1
Alta
| Vetor | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Kanboard versions prior to 1.2.31
Description
Kanboard is project management software that focuses on the Kanban methodology. In versions prior to 1.2.31, an authenticated user is able to perform a SQL Injection, leading to a privilege escalation or loss of confidentiality. It appears that in some insert and update operations, the code improperly uses the PicoDB library to update/insert new information.
Recommendations
For versions prior to 1.2.31, update to version 1.2.31 to resolve the issue. As a temporary workaround, consider restricting access to the PicoDB library until a patch is available. Avoid using the vulnerable insert and update operations in the affected code until the issue is resolved.
Exploit
Correção
LPE
SQL injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Kanboard
Picodb