Critical severity · published Jan 4, 2024
CVE-2023-50752
Online Notice Board System v1.0 - Multiple Unauthenticated SQL Injections (SQLi)
9.8
CVSS
0.7%
EPSS
No
On KEV
Description
Online Notice Board System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'e' parameter of the login.php resource does not validate the characters received and they are sent unfiltered to the database.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ON
Online Notice Board System · Kashipara Group
1.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-50752
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-50752
Exploit
https://fluidattacks.com/advisories/perahia/
Product
https://www.kashipara.com/
More from Online Notice Board System
9.8
CVE-2023-50753
Online Notice Board System v1.0 - Multiple Unauthenticated SQL Injections (SQLi)
9.8
CVE-2023-50743
Online Notice Board System v1.0 - Multiple Unauthenticated SQL Injections (SQLi)
8.8
CVE-2023-50760
Online Notice Board System v1.0 - Insecure File Upload