PT-2024-14504 · Examsys · Examsys

Published 2024-01-17 · Updated 2025-06-17 · CVE-2023-52285

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ExamSys version 9150244

Description The issue allows SQL Injection via the "/Support/action/Pages.php" endpoint, specifically through the s score2 parameter. This enables potential attackers to inject malicious SQL code, which could lead to unauthorized access or manipulation of sensitive data.

Recommendations For ExamSys version 9150244, consider restricting access to the "/Support/action/Pages.php" endpoint or avoiding the use of the s score2 parameter until a patch is available. As a temporary workaround, disabling the functionality related to this endpoint may help minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2023-52285

Affected Products

Examsys

References · 8

• 🔥 https://fh4ntke.medium.com/examsys-multiple-sql-injections-ef94d84e440c · Exploit
• https://github.com/lrx0014/ExamSys/commit/915024448428867f2228cf7f06abd1b6e65e9397 · Patch
• https://osv.dev/vulnerability/CVE-2023-52285 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-52285 · Security Note
• https://twitter.com/VulmonFeeds/status/1747580890060927182 · Twitter Post
• https://twitter.com/CVEnew/status/1747527257751437809 · Twitter Post
• https://t.me/cvenotify/125984 · Telegram Post
• https://t.me/cvenotify/68561 · Telegram Post