CVE-2023-39344CWE-89

social-media-skeleton vulnerable to Pre-Auth SQLi leading to RCE

Critical · published August 4, 2023

CVSS v3.1
10.0
EPSS
2%
Percentile
74.3
In the wild
Unconfirmed
What it is

🔥 A single rogue SQL query can unlock the entire server! This vulnerability in social-media-skeleton creates a backdoor for attackers to execute remote code—yikes! ⚠️ Think of it like leaving the backdoor of a café wide open while the front is all locked up tight. An attacker could stroll in through that backdoor, whip up a storm in the kitchen, and mess with everything without anyone noticing! With this SQL injection, an attacker could gain complete control over the server, allowing them to read sensitive data, modify files, or even inject their own malicious code. The consequences are absolutely devastating—imagine your precious data falling into the wrong hands or your entire application being compromised!

Put simply

Think of it like leaving the backdoor of a café wide open while the front is all locked up tight. An attacker could stroll in through that backdoor, whip up a storm in the kitchen, and mess with everything without anyone noticing! This SQL injection vulnerability allows attackers to perform UNION-based injections, leading to the potential for remote code execution. The lack of proper input validation opens the door wide for malicious queries to be executed on the database.

What to do

With this SQL injection, an attacker could gain complete control over the server, allowing them to read sensitive data, modify files, or even inject their own malicious code. The consequences are absolutely devastating—imagine your precious data falling into the wrong hands or your entire application being compromised! Immediately patch your project to the latest version including commit 3cabdd35c3d874608883c9eaf9bf69b2014d25c1. Implement parameterized queries to prevent SQL injections and conduct a thorough review of your database interactions. You've got this! Fix this vulnerability now and safeguard your project like the hero you are! 🛡️

The record
Technical detail
CVSS v3.1
10.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01512 · 74.3th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2023-08-04T19:49Z
EPSS history
Timeline
  • 04 AUG 19:49Z
    social-media-skeleton vulnerable to Pre-Auth SQLi leading to RCE
    cvelistv5