PT-2025-51317 · Anirbandutta9 · News-Buzz

Published 2025-12-15 · Updated 2025-12-21 · CVE-2023-38913

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions anirbandutta9 NEWS-BUZZ version 1.0

Description A SQL injection flaw exists in anirbandutta9 NEWS-BUZZ version 1.0. This allows a remote attacker to execute arbitrary code by using a crafted script. The vulnerability is due to insufficient input validation, potentially allowing malicious SQL commands to be injected through an unspecified vector. The script parameter may be involved in the injection.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2023-38913

Affected Products

News-Buzz

References · 7

• 🔥 https://gist.github.com/nguyenkhanhthuan/03ce706686508b14506d38788c754dfb · Exploit
• https://osv.dev/vulnerability/CVE-2023-38913 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-38913 · Security Note
• https://t.me/cveNotify/146260 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2000771384486617288 · Twitter Post
• https://github.com/ThuanNguyen115685/Report/blob/main/sqlinjection.md · Note
• https://twitter.com/CVEnew/status/2002857390996435181 · Twitter Post