CVE-2023-43013

Asset Management System v1.0 - Unauthenticated SQL Injection (SQLi)

State: Published
Severity: 9.8 Critical
Published: Sep 28, 2023
Updated: Sep 23, 2024
Reserved: Sep 14, 2023

Read the record on cve.org

Description

Asset Management System v1.0 is vulnerable to an

unauthenticated SQL Injection vulnerability on the

'email' parameter of index.php page, allowing an

external attacker to dump all the contents of the

database contents and bypass the login control.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Fluid Attacks

Weaknesses

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Affected Products

Product	Versions
Asset Management SystemAsset Management System	1.0Affected

References

https://fluidattacks.com/advisories/nergal
https://projectworlds.in/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.