Online Art Gallery v1.0 - Multiple Unauthenticated SQL Injections (SQLi)
CVE-2023-44267

9.8CRITICAL

Key Information:

Vendor

Projectworlds Pvt. Limited

Status
Online Art Gallery
Vendor
CVE Published:
26 October 2023

What is CVE-2023-44267?

The Online Art Gallery version 1.0 developed by Project Worlds is susceptible to severe SQL injection vulnerabilities. Specifically, the 'lnm' parameter in the header.php file does not adequately validate input, enabling attackers to execute unauthorized SQL queries. This oversight permits potential data exposure and manipulation within the database, posing significant risks to the integrity and confidentiality of the application’s stored data.

Affected Version(s)

Online Art Gallery 1.0

References

https://https://projectworlds.in/
https://fluidattacks.com/advisories/ono

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.