PT-2023-22634 · Unknown · Chatengine

Akshat Singhal · Published 2023-07-06 · Updated 2023-07-12 · CVE-2023-30325

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ChatEngine version 1.0

Description The issue allows attackers to gain sensitive information through a SQL Injection vulnerability in the textMessage parameter in the /src/chatbotapp/chatWindow.java file.

Recommendations For ChatEngine version 1.0, consider restricting access to the textMessage parameter in the /src/chatbotapp/chatWindow.java file to minimize the risk of exploitation. As a temporary workaround, avoid using the textMessage parameter in the affected API endpoint until the issue is resolved.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2023-30325

Affected Products

Chatengine

References · 4

• https://osv.dev/vulnerability/CVE-2023-30325 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-30325 · Security Note
• https://github.com/wliang6/ChatEngine/blob/fded8e710ad59f816867ad47d7fc4862f6502f3e/src/chatbotapp/chatWindow.java#L33:L60 · Note
• https://payatu.com/advisory/sql-injection-vulnerability-in-textmessage-field-in-chatengine-1-0 · Note