CVE-2023-39344
CriticalCVSS 10.0Exploitation Probability (EPSS)
Elevated risk66th percentile - higher than 66% of all known CVEs
Summary
The social-media-skeleton project has a SQL injection vulnerability that allows UNION based injections, which indirectly leads to remote code execution. A fix has been introduced in commit 3cabdd35c3d874608883c9eaf9bf69b2014d25c1.
Risk Assessment
This vulnerability could lead to serious security breaches, including remote code execution, posing a threat to the integrity of the organization's systems and data.
Recommendation
It is recommended to apply the fix from commit 3cabdd35c3d874608883c9eaf9bf69b2014d25c1 as soon as possible and conduct a security audit of the application.
Original NVD description (English source)
social-media-skeleton is an uncompleted social media project. A SQL injection vulnerability in the project allows UNION based injections, which indirectly leads to remote code execution. Commit 3cabdd35c3d874608883c9eaf9bf69b2014d25c1 contains a fix for this issue.