Campcodes Online Thesis Archiving System view_details.php sql injection
CVE-2023-2147

9.8CRITICAL

Key Information:

Vendor
Campcodes
Status
Online Thesis Archiving System
Vendor
CVE Published:
18 April 2023

Summary

A security vulnerability has been identified in the Campcodes Online Thesis Archiving System version 1.0, specifically in the file /admin/students/view_details.php. This vulnerability allows an attacker to manipulate the 'id' argument, leading to unauthorized SQL queries that can compromise the database. The issue can be exploited remotely, making it critical for users to take immediate precautions to safeguard their data and prevent potential unauthorized access.

Affected Version(s)

Online Thesis Archiving System 1.0

References

https://vuldb.com/?id.226268
vdb-entrytechnical-description
https://vuldb.com/?ctiid.226268
signaturepermissions-required
https://github.com/E1CHO/cve_hub/blob/main/Online%20Thesi...
exploit

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

SSL_Seven_Security Lab_WangZhiQiang_XiaoZiLong (VulDB User)
.
CVE-2023-2147 : Campcodes Online Thesis Archiving System view_details.php sql injection | SecurityVulnerability.io