Lucene search
HistoryAug 15, 2023 - 10:15 p.m.
CVE-2023-39851
cve-2023-39851
webchess v1.0
sql injection
mainmenu.php
session variable
exploitation
CVSS3
9.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
0.001
Percentile
48.4%
webchess v1.0 was discovered to contain a SQL injection vulnerability via the $playerID parameter at mainmenu.php. NOTE: this is disputed by a third party who indicates that the playerID is a session variable controlled by the server, and thus cannot be used for exploitation.
Affected configurations
Node
webchess_projectwebchessMatch1.0
| Vendor | Product | Version | CPE |
|---|---|---|---|
| webchess_project | webchess | 1.0 | cpe:2.3:a:webchess_project:webchess:1.0:*:*:*:*:*:*:* |
Related
cvelist
cvelist
CVE-2023-39851
2023-08-15 00:00:00
prion
prion
Sql injection
2023-08-15 22:15:00
cve
cve
CVE-2023-39851
2023-08-15 22:15:14
cnvd
cnvd
WebChess SQL Injection Vulnerability (CNVD-2023-64111)
2023-08-17 00:00:00
CVSS3
9.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
0.001
Percentile
48.4%
Related for NVD:CVE-2023-39851