PT-2020-15591 · Projectworlds · Projects World House Rental

Published 2020-09-15 · Updated 2020-09-18 · CVE-2020-23833

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Projectworlds House Rental version 1.0

Description The issue allows remote attackers to execute arbitrary code on the hosting webserver. This is achieved through an unauthenticated SQL Injection vulnerability via a malicious index.php POST request.

Recommendations For Projectworlds House Rental version 1.0, consider restricting access to the index.php file until a patch is available to prevent exploitation of the SQL Injection vulnerability.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2020-23833

Affected Products

Projects World House Rental

References · 5

• 🔥 https://packetstormsecurity.com/files/158811/House-Rental-1.0-SQL-Injection.html · Exploit
• https://osv.dev/vulnerability/CVE-2020-23833 · Vendor Advisory
• https://projectworlds.in · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-23833 · Security Note
• https://projectworlds.in/wp-content/uploads/2019/06/home-rental.zip · Vendor Advisory