CVE-2023-53972

HIGH

WebTareas 2.4 - SQL Injection

Title source: llm

Description

WebTareas 2.4 contains a SQL injection vulnerability in the webTareasSID cookie parameter that allows unauthenticated attackers to manipulate database queries. Attackers can exploit error-based and time-based blind SQL injection techniques to extract database information and potentially access sensitive system data.

Exploits (1)

exploitdb WORKING POC

by Hubert Wojciechowski · textwebappsphp

https://www.exploit-db.com/exploits/51087

View Code ZIP pw:eip

References (3)

[Product] https://sourceforge.net/projects/webtareas/

[Exploit] https://www.exploit-db.com/exploits/51087

[Exploit, Third Party Advisory] https://www.vulncheck.com/advisories/webtareas-unauthenticated-sql-injection-via-session-cookie-parameter

Scores

CVSS v3 7.5

EPSS 0.0010

EPSS Percentile 26.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE

CWE-89

Status published

Products (2)

luiswang/WebTareas 2.4

webtareas_project/webtareas 2.4

Published Dec 22, 2025

Tracked Since Feb 18, 2026