XiaoBingBy TeaCMS up to 2.0.2 /admin/getallarticleinfo searchInfo sql injection

A vulnerability has been found in XiaoBingBy TeaCMS up to 2.0.2 and classified as critical. This vulnerability affects unknown code of the file /admin/getallarticleinfo. The manipulation of the argument searchInfo leads to sql injection. Using CWE to declare the problem leads to CWE-89. The weakness was released 03/18/2023. The advisory is available at gitee.com. This vulnerability was named CVE-2023-1483. The attack can be initiated remotely. Technical details are available. There is no exploit available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment. This vulnerability is assigned to T1505 by the MITRE ATT&CK project. It is declared as not defined. As 0-day the estimated underground price was around $0-$5k. A possible mitigation has been published before and not just after the disclosure of the vulnerability.

Field03/18/2023 09:4504/11/2023 17:1804/11/2023 17:26
vendorXiaoBingByXiaoBingByXiaoBingBy
nameTeaCMSTeaCMSTeaCMS
version<=2.0.2<=2.0.2<=2.0.2
file/admin/getallarticleinfo/admin/getallarticleinfo/admin/getallarticleinfo
argumentsearchInfosearchInfosearchInfo
cwe89 (sql injection)89 (sql injection)89 (sql injection)
risk222
cvss3_vuldb_avNNN
cvss3_vuldb_acLLL
cvss3_vuldb_uiNNN
cvss3_vuldb_sUUU
cvss3_vuldb_cLLL
cvss3_vuldb_iLLL
cvss3_vuldb_aLLL
cvss3_vuldb_rcRRR
urlhttps://gitee.com/xiaobingby/TeaCMS/issues/I6IJ0Khttps://gitee.com/xiaobingby/TeaCMS/issues/I6IJ0Khttps://gitee.com/xiaobingby/TeaCMS/issues/I6IJ0K
cveCVE-2023-1483CVE-2023-1483CVE-2023-1483
responsibleVulDBVulDBVulDB
date1679094000 (03/18/2023)1679094000 (03/18/2023)1679094000 (03/18/2023)
cvss2_vuldb_avNNN
cvss2_vuldb_acLLL
cvss2_vuldb_ciPPP
cvss2_vuldb_iiPPP
cvss2_vuldb_aiPPP
cvss2_vuldb_rcURURUR
cvss2_vuldb_auSSS
cvss2_vuldb_eNDNDND
cvss2_vuldb_rlNDNDND
cvss3_vuldb_prLLL
cvss3_vuldb_eXXX
cvss3_vuldb_rlXXX
cvss2_vuldb_basescore6.56.56.5
cvss2_vuldb_tempscore6.26.26.2
cvss3_vuldb_basescore6.36.36.3
cvss3_vuldb_tempscore6.16.16.1
cvss3_meta_basescore6.36.37.5
cvss3_meta_tempscore6.16.17.4
price_0day$0-$5k$0-$5k$0-$5k
cve_assigned1679094000 (03/18/2023)1679094000 (03/18/2023)
cve_nvd_summaryA vulnerability has been found in XiaoBingBy TeaCMS up to 2.0.2 and classified as critical. This vulnerability affects unknown code of the file /admin/getallarticleinfo. The manipulation of the argument searchInfo leads to sql injection. The attack can be initiated remotely. VDB-223366 is the identifier assigned to this vulnerability.A vulnerability has been found in XiaoBingBy TeaCMS up to 2.0.2 and classified as critical. This vulnerability affects unknown code of the file /admin/getallarticleinfo. The manipulation of the argument searchInfo leads to sql injection. The attack can be initiated remotely. VDB-223366 is the identifier assigned to this vulnerability.
cvss3_nvd_avN
cvss3_nvd_acL
cvss3_nvd_prN
cvss3_nvd_uiN
cvss3_nvd_sU
cvss3_nvd_cH
cvss3_nvd_iH
cvss3_nvd_aH
cvss2_nvd_avN
cvss2_nvd_acL
cvss2_nvd_auS
cvss2_nvd_ciP
cvss2_nvd_iiP
cvss2_nvd_aiP
cvss3_cna_avN
cvss3_cna_acL
cvss3_cna_prL
cvss3_cna_uiN
cvss3_cna_sU
cvss3_cna_cL
cvss3_cna_iL
cvss3_cna_aL
cve_cnaVulDB
cvss2_nvd_basescore6.5
cvss3_nvd_basescore9.8
cvss3_cna_basescore6.3

Want to stay up to date on a daily basis?

Enable the mail alert feature now!