Campcodes Online Thesis Archiving System projects_per_curriculum.php sql injection
CVE-2023-2145

9.8CRITICAL

Key Information:

Vendor
Campcodes
Status
Online Thesis Archiving System
Vendor
CVE Published:
18 April 2023

Summary

A vulnerability exists in Campcodes Online Thesis Archiving System 1.0, allowing remote exploitation through SQL injection. Specifically, manipulation of the 'id' argument in the 'projects_per_curriculum.php' file can lead to unauthorized database access. This issue has been disclosed publicly, heightening the urgency for immediate remediation to prevent potential exploitation.

Affected Version(s)

Online Thesis Archiving System 1.0

References

https://vuldb.com/?id.226266
vdb-entrytechnical-description
https://vuldb.com/?ctiid.226266
signaturepermissions-required
https://github.com/E1CHO/cve_hub/blob/main/Online%20Thesi...
exploit

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

SSL_Seven_Security Lab_WangZhiQiang_XiaoZiLong (VulDB User)
.
CVE-2023-2145 : Campcodes Online Thesis Archiving System projects_per_curriculum.php sql injection | SecurityVulnerability.io