SQL Injection

2023-11-2800:17:27

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

sql injection

hoteldruid

vulnerability

sanitization

user inputs

unauthorized access

data access

post parameter

malicious commands

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7.2

Confidence

Low

EPSS

0.01

Percentile

83.6%

JSON

hoteldruid is vulnerable to SQL Injection. The vulnerability is due to there is no sanitization of user inputs in id_utente_log POST parameter. This allows an attacker to inject malicious SQL commands, and potentially leads to unauthorized data access.