CVE-2023-39851
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk49th percentile - higher than 49% of all known CVEs
Summary
Version 1.0 of webchess was found to contain a SQL injection vulnerability via the $playerID parameter in mainmenu.php. However, there is controversy regarding this vulnerability as a third party claims that playerID is a session variable controlled by the server, making it impossible to exploit.
Risk Assessment
This vulnerability could lead to unauthorized access to the database, but the controversy surrounding its existence may reduce the risk of exploitation.
Recommendation
It is recommended to conduct a security audit of the application and monitor for any attempts to exploit this vulnerability, despite the doubts about its existence.
Original NVD description (English source)
webchess v1.0 was discovered to contain a SQL injection vulnerability via the $playerID parameter at mainmenu.php. NOTE: this is disputed by a third party who indicates that the playerID is a session variable controlled by the server, and thus cannot be used for exploitation.