CVE-2023-34249
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
PyBB is an open source bulletin board that was vulnerable to SQL Injection prior to commit dcaeccd37198ecd3e41ea766d1099354b60d69c2. This issue has been fixed in the mentioned commit.
Risk Assessment
Exploitation of this vulnerability could lead to unauthorized access to the database and leakage of sensitive information. Organizations using this version of the software should update their systems as soon as possible.
Recommendation
It is recommended to update the software to the latest version to eliminate the vulnerability. Alternatively, users may manually update the software by sanitizing user queries in the `BulletinDatabaseModule.py` file.
Original NVD description (English source)
benjjvi/PyBB is an open source bulletin board. Prior to commit dcaeccd37198ecd3e41ea766d1099354b60d69c2, benjjvi/PyBB is vulnerable to SQL Injection. This vulnerability has been fixed as of commit dcaeccd37198ecd3e41ea766d1099354b60d69c2. As a workaround, a user may be able to update the software manually to avoid this problem by sanitizing user queries to `BulletinDatabaseModule.py`.