PT-2021-10924 · Unknown · 188Jianzhan

Shu1Lop · Published 2021-11-02 · Updated 2023-02-24 · CVE-2020-23685

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions 188Jianzhan version 2.1.0

Description The issue allows attackers to execute arbitrary code and gain escalated privileges. This is achieved via the username parameter to the "login.php" endpoint.

Recommendations For 188Jianzhan version 2.1.0, consider restricting access to the "login.php" endpoint until a fix is available, and avoid using the username parameter in this endpoint to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2020-23685

Affected Products

188Jianzhan

References · 4

• 🔥 https://github.com/vtime-tech/188Jianzhan/issues/2 · Exploit
• https://osv.dev/vulnerability/CVE-2020-23685 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-23685 · Security Note
• https://t.me/cvenotify/44916 · Telegram Post