CVE-2023-7144

MEDIUM

masterlab < 3.3.10 - SQL Injection via HTTP POST Request Handler

Title source: llm

Description

A vulnerability classified as critical has been found in gopeak MasterLab up to 3.3.10. This affects the function sqlInject of the file app/ctrl/framework/Feature.php of the component HTTP POST Request Handler. The manipulation of the argument pwd leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249147.

References (3)

Core 3

Core References

Permissions Required, Third Party Advisory vdb-entry technical-description

https://vuldb.com/?id.249147

Permissions Required, Third Party Advisory signature permissions-required

https://vuldb.com/?ctiid.249147

Broken Link broken-link exploit

https://note.zhaoj.in/share/4HDWrBHGCf9e

Scores

CVSS v3 6.3

EPSS 0.0057

EPSS Percentile 43.0%

Attack Vector ADJACENT_NETWORK

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-89

Status published

Products (1)

masterlab/masterlab < 3.3.10

Published Dec 29, 2023

Tracked Since Feb 18, 2026