CRITICAL
PictureThisWebServer user.js router.post sql injection
Published Jan 16, 2023
9.8
CRITICALCVSS 3.1
EPSS 0.69%
Description
A vulnerability was found in PictureThisWebServer and classified as critical. This issue affects the function router.post of the file routes/user.js. The manipulation of the argument username/password leads to sql injection. The patch is named 68b9dc346e88b494df00d88c7d058e96820e1479. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218399.
Affected products
- Vendor n/a Product PictureThisWebServer Defaultn/a
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||
|---|---|---|---|---|---|---|
| n/a | PictureThisWebServer | n/a |
|
- < 2015-02-23
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (1)
References (4)
- https://github.com/jan-rodriguez/PictureThisWebServer/commit/68b9dc346e88b494df00d88c7d058e96820e1479 patchThird Party Advisory
- https://github.com/jan-rodriguez/PictureThisWebServer/pull/1 issue-trackingPatchThird Party Advisory
- https://vuldb.com/?ctiid.218399 signaturepermissions-requiredPermissions RequiredThird Party Advisory
- https://vuldb.com/?id.218399 vdb-entrytechnical-descriptionPermissions RequiredThird Party Advisory
| Link | Providers | Tags |
|---|---|---|
| https://github.com/jan-rodriguez/PictureThisWebServer/commit/68b9dc346e88b494df00d88c7d058e96820e1479 | patchThird Party Advisory | |
| https://github.com/jan-rodriguez/PictureThisWebServer/pull/1 | issue-trackingPatchThird Party Advisory | |
| https://vuldb.com/?ctiid.218399 | signaturepermissions-requiredPermissions RequiredThird Party Advisory | |
| https://vuldb.com/?id.218399 | vdb-entrytechnical-descriptionPermissions RequiredThird Party Advisory |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner VulDB
Published Jan 16, 2023
Updated Aug 6, 2024
Reserved Jan 15, 2023
Link CVE-2015-10055
CISA Vulnrichment
Updated n/a