CVE-2023-7146
Assigner: VulDB
Published: 2023-12-29T02:00:05.328Z
State: PUBLISHED
title: gopeak MasterLab HTTP POST Request Feature.php sqlInjectDelete sql injection
problemTypes: descriptions: type: CWE
cweId: CWE-89
description: CWE-89 SQL Injection
affected: vendor: gopeak
product: MasterLab
versions: version: 3.3.0
status: affected
version: 3.3.1
status: affected
version: 3.3.2
status: affected
version: 3.3.3
status: affected
version: 3.3.4
status: affected
version: 3.3.5
status: affected
version: 3.3.6
status: affected
version: 3.3.7
status: affected
version: 3.3.8
status: affected
version: 3.3.9
status: affected
version: 3.3.10
status: affected
modules: HTTP POST Request Handler
descriptions: value: A vulnerability, which was classified as critical, has been found in gopeak MasterLab up to 3.3.10. This issue affects the function sqlInjectDelete of the file app/ctrl/framework/Feature.php of the component HTTP POST Request Handler. The manipulation of the argument phone leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier VDB-249149 was assigned to this vulnerability.
value: Eine Schwachstelle wurde in gopeak MasterLab bis 3.3.10 entdeckt. Sie wurde als kritisch eingestuft. Hierbei geht es um die Funktion sqlInjectDelete der Datei app/ctrl/framework/Feature.php der Komponente HTTP POST Request Handler. Durch Beeinflussen des Arguments phone mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Der Exploit steht zur öffentlichen Verfügung.
metrics: cvssV3_1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
cvssV3_0: version: 3.0
baseScore: 6.3
vectorString: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
cvssV2_0: version: 2.0
baseScore: 5.8
vectorString: AV:A/AC:L/Au:N/C:P/I:P/A:P
timeline: time: 2023-12-28T00:00:00.000Z
value: Advisory disclosed
time: 2023-12-28T00:00:00.000Z
value: CVE reserved
time: 2023-12-28T01:00:00.000Z
value: VulDB entry created
time: 2024-01-20T09:33:18.000Z
value: VulDB entry last update
credits: value: glzjin (VulDB User)
type: reporter