PT-2023-32326 · Unknown · Shaanxi Chanming Education Technology Score Query System

Ting · Publicado 2023-10-26 · Atualizado 2024-05-17 · CVE-2023-5787

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Shaanxi Chanming Education Technology Score Query System version 5.0

Description A critical issue affects the system's unknown processing, allowing for SQL injection through the manipulation of the stuIdCard argument. The attack can be initiated remotely.

Recommendations For version 5.0, consider disabling the stuIdCard argument until a patch is available to prevent SQL injection attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2023-5787

Produtos afetados

Shaanxi Chanming Education Technology Score Query System

Referências · 8

• 🔥❌ https://github.com/Echosssy/-SQL-injection-exists-in-the-score-query-system/blob/main/README.md · Exploit, Deleted
• https://twitter.com/VulmonFeeds/status/1717617663503999036 · Publicação no Twitter
• https://vuldb.com/?id.243593 · Nota
• https://twitter.com/CVEnew/status/1717566479355220023 · Publicação no Twitter
• https://t.me/cibsecurity/72980 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-5787 · Aviso do Fabricante
• https://vuldb.com/?ctiid.243593 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-5787 · Nota de Segurança