CVE-2023-45120: Online Examination System v1.0 - Multiple Authenticated SQL Injections (SQLi)

Published Dec 21, 2023

Updated

Online Examination System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'qid' parameter of the /update.php?q=quiz&step=2 resource does not validate the characters received and they are sent unfiltered to the database.

Affected Software

1 affected component

Projectworlds Online Examination System=1.0

Event History

Dec 21, 2023

CVE Published

via MITRE·04:21 PM

Data Sourced

via MITRE·04:21 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2023-45120?

CVE-2023-45120 has a high severity due to its potential for exploiting authenticated SQL injection vulnerabilities.

How do I fix CVE-2023-45120?

To fix CVE-2023-45120, sanitize and validate the 'qid' parameter to prevent unfiltered data from reaching the database.

What are the consequences of exploiting CVE-2023-45120?

Exploiting CVE-2023-45120 can lead to unauthorized database access, data leakage, or manipulation of quiz results.

Which software versions are affected by CVE-2023-45120?

CVE-2023-45120 affects Online Examination System version 1.0.

Is CVE-2023-45120 an authenticated vulnerability?

Yes, CVE-2023-45120 is an authenticated SQL injection vulnerability, requiring user access to exploit.