PT-2023-29180 · Unknown · Online Art Gallery

Andres Roldan · CVE-2023-44267 · Publicado 2023-10-26 · Atualizado 2025-05-20

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Online Art Gallery version 1.0

Description The issue concerns multiple Unauthenticated SQL Injection vulnerabilities. The lnm parameter of the header.php resource does not validate the characters received and they are sent unfiltered to the database.

Recommendations For Online Art Gallery version 1.0, as a temporary workaround, consider restricting the use of the lnm parameter in the header.php resource until a patch is available. Avoid using the lnm parameter in the affected resource to minimize the risk of exploitation.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2023-44267

Produtos afetados

Online Art Gallery

Referências · 8

• 🔥 https://fluidattacks.com/advisories/ono · Exploit
• https://https//projectworlds.in · Nota
• https://twitter.com/CVEnew/status/1717623002559652176 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-44267 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-44267 · Aviso do Fabricante
• https://t.me/cibsecurity/73016 · Publicação no Telegram
• https://twitter.com/fluidattacks/status/1924919808346206559 · Publicação no Twitter
• https://t.me/cvenotify/60048 · Publicação no Telegram