INCIBECVELIST:CVE-2022-41680CVE-2022-41680 SQL Injection in Forma LMS
7.6 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
LOW
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
8.5 High
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
28.4%
Forma LMS on its 3.1.0 version and earlier is vulnerable to a SQL injection vulnerability. The exploitation of this vulnerability could allow an authenticated attacker (with the role of student) to perform a SQL injection on the ‘search[value] parameter in the appLms/ajax.server.php?r=mycertificate/getMyCertificates’ function in order to dump the entire database.
CNA Affected
[
{
"vendor": "Forma",
"product": "Forma LMS",
"versions": [
{
"version": "3.0.1",
"status": "affected",
"lessThanOrEqual": "3.1.0",
"versionType": "custom"
}
]
}
]Related
7.6 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
LOW
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
8.5 High
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
28.4%