PT-2023-32649 · Unknown · Voovi Social Networking Script

Rafael Pedrero · Published 2023-11-30 · Updated 2023-12-02 · CVE-2023-6418

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Voovi Social Networking Script version 1.0

Description A SQL injection vulnerability has been reported, affecting the videos.php endpoint in the id parameter. This could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the application.

Recommendations For version 1.0, consider disabling access to the videos.php endpoint or restricting the use of the id parameter until a patch is available. As a temporary workaround, avoid using the id parameter in the videos.php endpoint to minimize the risk of exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2023-6418

Affected Products

Voovi Social Networking Script

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2023-6418 · Security Note
• https://osv.dev/vulnerability/CVE-2023-6418 · Vendor Advisory
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-voovi-social-networking-script · Note
• https://twitter.com/CVEnew/status/1730219726209495469 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1730252488844952004 · Twitter Post