CVE-2023-39344
CriticalCVSS 10.0Exploitation Probability (EPSS)
Elevated risk66th percentile - higher than 66% of all known CVEs
Summary
The social-media-skeleton project has a SQL injection vulnerability that allows UNION based injections, which indirectly leads to remote code execution. A fix has been introduced in commit 3cabdd35c3d874608883c9eaf9bf69b2014d25c1.
Risk Assessment
This vulnerability could lead to serious security breaches, including remote code execution, posing a threat to the integrity of the organization's systems and data.
Recommendation
It is recommended to apply the fix from commit 3cabdd35c3d874608883c9eaf9bf69b2014d25c1 as soon as possible and conduct a security audit of the application.
Other vulnerabilities in social-media-skeleton
See all- CVE-2023-40174Medium
CVE-2023-40174 affects the Social media skeleton project, which improperly manages the user session lifecycle. Versions prior to 1.0.5 did not adequately limit session duration, posing a risk of unauthorized access.
- CVE-2023-40173High
Social Media Skeleton prior to version 1.0.5 did not properly salt passwords, making them susceptible to cracking if an attacker gained access to hashed passwords.
- CVE-2023-40172Medium
CVE-2023-40172 affects the Social media skeleton project, which prior to version 1.0.5 did not properly restrict Cross-site request forgery (CSRF) attacks. An attacker could trick a victim into performing unintended actions on a website.
- CVE-2023-39518Medium
The social-media-skeleton project, implemented using PHP, MySQL, CSS, JavaScript, and HTML, has a stored XSS vulnerability in versions 1.0.0 to 1.0.3. The issue is patched in version 1.0.3.
Original NVD description (English source)
social-media-skeleton is an uncompleted social media project. A SQL injection vulnerability in the project allows UNION based injections, which indirectly leads to remote code execution. Commit 3cabdd35c3d874608883c9eaf9bf69b2014d25c1 contains a fix for this issue.