Campcodes Online Thesis Archiving System Master.php sql injection
CVE-2023-2146

9.8CRITICAL

Key Information:

Vendor
Campcodes
Status
Online Thesis Archiving System
Vendor
CVE Published:
18 April 2023

Summary

A SQL injection vulnerability exists in Campcodes Online Thesis Archiving System 1.0, specifically within the file classes/Master.php. The flaw arises from improper handling of the argument name, allowing attackers to manipulate inputs and execute arbitrary SQL queries. This vulnerability can be exploited remotely, posing a significant risk to data integrity and security. With publicly disclosed exploits available, immediate action is crucial for affected users to mitigate potential attacks.

Affected Version(s)

Online Thesis Archiving System 1.0

References

https://vuldb.com/?id.226267
vdb-entrytechnical-description
https://vuldb.com/?ctiid.226267
signaturepermissions-required
https://github.com/E1CHO/cve_hub/blob/main/Online%20Thesi...
exploit

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

SSL_Seven_Security Lab_WangZhiQiang_XiaoZiLong (VulDB User)
.
CVE-2023-2146 : Campcodes Online Thesis Archiving System Master.php sql injection | SecurityVulnerability.io