Vulnerability · Published Sep 28, 2023 · Assigned by Fluid Attacks
CVE-2023-43013Asset Management System v1.0 - Unauthenticated SQL Injection (SQLi)
Critical 9.8
In plain English
A critical-severity SQL injection in Asset Management System from Asset Management System. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.9%top 41.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Asset Management System v1.0 is vulnerable to an unauthenticated SQL Injection vulnerability on the 'email' parameter of index.php page, allowing an external attacker to dump all the contents of the database contents and bypass the login control.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Asset Management System | Asset Management System | 1.0 |
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H