PT-2023-18800 · Webchess · Webchess

Ac · Published 2023-01-11 · Updated 2023-01-18 · CVE-2023-22959

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WebChess versions 0.9.0 and 1.0.0.rc2

Description The issue allows SQL injection in WebChess, affecting files such as mainmenu.php, chess.php, and opponentspassword.php. Specifically, the txtFirstName and txtLastName variables are vulnerable.

Recommendations For versions 0.9.0 and 1.0.0.rc2, consider restricting access to the mainmenu.php, chess.php, and opponentspassword.php files until a patch is available. As a temporary workaround, avoid using the txtFirstName and txtLastName variables in these files to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2023-22959

Affected Products

Webchess

References · 6

• 🔥 https://github.com/chenan224/webchess_sqli_poc · Exploit
• https://osv.dev/vulnerability/CVE-2023-22959 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-22959 · Security Note
• https://t.me/cvenotify/42337 · Telegram Post
• https://sourceforge.net/p/webchess/bugs/84 · Note
• https://t.me/cibsecurity/56331 · Telegram Post