PT-2023-25704 · Picodb+1 · Picodb+1
Riccardobonafede
·
Published
2023-07-05
·
Updated
2025-04-10
·
CVE-2023-36813
CVSS v3.1
7.1
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Kanboard versions prior to 1.2.31
Description
Kanboard is project management software that focuses on the Kanban methodology. In versions prior to 1.2.31, an authenticated user is able to perform a SQL Injection, leading to a privilege escalation or loss of confidentiality. It appears that in some insert and update operations, the code improperly uses the PicoDB library to update/insert new information.
Recommendations
For versions prior to 1.2.31, update to version 1.2.31 to resolve the issue. As a temporary workaround, consider restricting access to the PicoDB library until a patch is available. Avoid using the vulnerable insert and update operations in the affected code until the issue is resolved.
Exploit
Fix
LPE
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Kanboard
Picodb