CVE-2023-36311
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk47th percentile - higher than 47% of all known CVEs
Summary
In version 1.0 of PHPJabbers Document Creator, there is a SQL injection (SQLi) vulnerability in the 'column' parameter of index.php.
Risk Assessment
An attacker could exploit this vulnerability to gain unauthorized access to the database, potentially leading to the disclosure of sensitive information.
Recommendation
It is recommended to update to the latest version of the software and to validate and sanitize input data in the application.
Other vulnerabilities in PHPJabbers Document Creator v1.0
See all- CVE-2023-40758Critical
User enumeration is found in PHPJabbers Document Creator v1.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.
- CVE-2023-36313Medium
PHPJabbers Document Creator version 1.0 is vulnerable to Cross Site Scripting (XSS) via all POST parameters of 'Export Requests' except for 'request_feed'.
- CVE-2023-36310Medium
There is a Cross Site Scripting (XSS) vulnerability in the 'column' parameter of index.php in PHPJabbers Document Creator v1.0.
- CVE-2023-36309Medium
There is a Cross Site Scripting (XSS) vulnerability in the 'action' parameter of index.php in PHPJabbers Document Creator v1.0.
Original NVD description (English source)
There is a SQL injection (SQLi) vulnerability in the "column" parameter of index.php in PHPJabbers Document Creator v1.0.