CVE-2021-23837

An issue was discovered in flatCore before 2.0.0 build 139

published January 15, 2021

CVSS
—
EPSS
1%
Percentile
73.7
In the wild
Unconfirmed
What it is

An issue was discovered in flatCore before 2.0.0 build 139. A time-based blind SQL injection was identified in the selected_folder HTTP request body parameter for the acp interface. The affected parameter (which retrieves the file contents of the specified folder) was found to be accepting malicious user input without proper sanitization, thus leading to SQL injection. Database related information can be successfully retrieved.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01481 · 73.7th percentile
Published
2021-01-15T06:27Z
EPSS history
Timeline
  • 15 JAN 06:27Z
    An issue was discovered in flatCore before 2.0.0 build 139
    cvelistv5