CVE-2023-36076
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk82th percentile - higher than 82% of all known CVEs
Summary
Version 3.1.9 and earlier of smanga contains an SQL Injection vulnerability that allows remote attackers to execute arbitrary code and gain sensitive information via mediaId, mangaId, and userId parameters in php/history/add.php.
Risk Assessment
This vulnerability could lead to unauthorized access to data and potential system takeover, posing a serious threat to the organization's security.
Recommendation
It is recommended to update smanga to a version newer than 3.1.9 and implement additional security measures such as input validation.
Original NVD description (English source)
SQL Injection vulnerability in smanga version 3.1.9 and earlier, allows remote attackers to execute arbitrary code and gain sensitive information via mediaId, mangaId, and userId parameters in php/history/add.php.