CVE-2023-44482 - Vulnerability Details - OpenCVE

ReportizFlow

Leave Management System Project v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'setsickleave' parameter of the admin/setleaves.php resource does not validate the characters received and they are sent unfiltered to the database.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Projectworlds	Leave Management System

Configuration 1 [-]

cpe:2.3:a:projectworlds:leave_management_system:1.0:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://fluidattacks.com/advisories/martin/
https://projectworlds.in/

History

Wed, 27 Nov 2024 19:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: Fluid Attacks

Published: 2023-12-21T18:59:05.773Z

Updated: 2024-11-27T18:42:26.664Z

Reserved: 2023-09-29T14:42:05.477Z

Link: CVE-2023-44482

Vulnrichment

Updated: 2024-08-02T20:07:33.468Z

NVD

Status : Modified

Published: 2023-12-21T19:15:09.157

Modified: 2024-11-21T08:25:58.217

Link: CVE-2023-44482

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-44482", "assignerOrgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869", "state": "PUBLISHED", "assignerShortName": "Fluid Attacks", "dateReserved": "2023-09-29T14:42:05.477Z", "datePublished": "2023-12-21T18:59:05.773Z", "dateUpdated": "2024-11-27T18:42:26.664Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Leave Management System Project", "vendor": "Projectworlds Pvt. Limited", "versions": [{"status": "affected", "version": "1.0"}]}], "datePublic": "2023-10-27T17:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Leave Management System Project v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'setsickleave' parameter of the admin/setleaves.php resource does not validate the characters received and they are sent unfiltered to the database.</p>"}], "value": "Leave Management System Project v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities.\u00a0The 'setsickleave' parameter of the admin/setleaves.php resource does not validate the characters received and they are sent unfiltered to the database.\n\n"}], "impacts": [{"capecId": "CAPEC-66", "descriptions": [{"lang": "en", "value": "CAPEC-66 SQL Injection"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869", "shortName": "Fluid Attacks", "dateUpdated": "2023-12-21T18:59:05.773Z"}, "references": [{"url": "https://projectworlds.in/"}, {"url": "https://fluidattacks.com/advisories/martin/"}], "source": {"discovery": "UNKNOWN"}, "title": "Leave Management System Project v1.0 - Multiple Authenticated SQL Injections (SQLi)", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T20:07:33.468Z"}, "title": "CVE Program Container", "references": [{"url": "https://projectworlds.in/", "tags": ["x_transferred"]}, {"url": "https://fluidattacks.com/advisories/martin/", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-11-27T18:42:12.308725Z", "id": "CVE-2023-44482", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-27T18:42:26.664Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://projectworlds.in/", "tags": ["x_transferred"]}, {"url": "https://fluidattacks.com/advisories/martin/", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T20:07:33.468Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-44482", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-11-27T18:42:12.308725Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-27T18:42:19.900Z"}}], "cna": {"title": "Leave Management System Project v1.0 - Multiple Authenticated SQL Injections (SQLi)", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-66", "descriptions": [{"lang": "en", "value": "CAPEC-66 SQL Injection"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Projectworlds Pvt. Limited", "product": "Leave Management System Project", "versions": [{"status": "affected", "version": "1.0"}], "defaultStatus": "unaffected"}], "datePublic": "2023-10-27T17:00:00.000Z", "references": [{"url": "https://projectworlds.in/"}, {"url": "https://fluidattacks.com/advisories/martin/"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "Leave Management System Project v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities.\u00a0The 'setsickleave' parameter of the admin/setleaves.php resource does not validate the characters received and they are sent unfiltered to the database.\n\n", "supportingMedia": [{"type": "text/html", "value": "<p>Leave Management System Project v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'setsickleave' parameter of the admin/setleaves.php resource does not validate the characters received and they are sent unfiltered to the database.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869", "shortName": "Fluid Attacks", "dateUpdated": "2023-12-21T18:59:05.773Z"}}}, "cveMetadata": {"cveId": "CVE-2023-44482", "state": "PUBLISHED", "dateUpdated": "2024-11-27T18:42:26.664Z", "dateReserved": "2023-09-29T14:42:05.477Z", "assignerOrgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869", "datePublished": "2023-12-21T18:59:05.773Z", "assignerShortName": "Fluid Attacks"}, "dataVersion": "5.1"}