CVE-2023-39344 social-media-skeleton vulnerable to Pre-Auth SQLi leading to RCE
An attacker can exploit a pre-authentication SQL injection vulnerability in the social-media-skeleton project to achieve remote code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-39344?
CVE-2023-39344 is a critical SQL injection vulnerability in fobybus social-media-skeleton, published on 4 Aug 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
social-media-skeleton is an uncompleted social media project. A SQL injection vulnerability in the project allows UNION based injections, which indirectly leads to remote code execution. Commit 3cabdd35c3d874608883c9eaf9bf69b2014d25c1 contains a fix for this issue.
Weakness: CWE-89
Which versions are affected by CVE-2023-39344?
It affects 1 product.
Products include Fobybus Social-Media-Skeleton.
How do I fix CVE-2023-39344?
No fix has been published for CVE-2023-39344 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2023-39344 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-39344 exists.
Other vulnerabilities in fobybus social-media-skeleton
- CVE-2023-40173 Unsalted passwords in fobybus/social-media-skeleton
- CVE-2023-40174 Insufficient Session Expiration in fobybus/social-media-skeleton
- CVE-2023-40172 Cross-Site Request Forgery (CSRF) in fobybus/social-media-skeleton
- CVE-2023-39518 social-media-skeleton stored Cross-site Scripting vulnerability
Sources
Also known as GHSA-857x-p6fq-mgfh.