Vulnerability · Published Sep 21, 2023 · Assigned by GitHub_M

CVE-2023-42807Frappe LMS SQL Injection Issue on People Page

Medium 6.3

In plain English

A medium-severity SQL injection in lms from frappe. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.4%top 65.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Frappe LMS is an open source learning management system. In versions 1.0.0 and prior, on the People Page of LMS, there was an SQL Injection vulnerability. The issue has been fixed in the `main` branch. Users won't face this issue if they are using the latest main branch of the app.

Affected products (as reported)

Vendor	Product	Versions
frappe	lms	<= 1.0

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

References

https://github.com/frappe/lms/security/advisories/GHSA-wvq3-3wvp-6x63 x_refsource_CONFIRM