Critical severity · published Sep 28, 2023
CVE-2023-43013
Asset Management System v1.0 - Unauthenticated SQL Injection (SQLi)
9.8
CVSS
0.9%
EPSS
No
On KEV
Description
Asset Management System v1.0 is vulnerable to an
unauthenticated SQL Injection vulnerability on the
'email' parameter of index.php page, allowing an
external attacker to dump all the contents of the
database contents and bypass the login control.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 59% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AM
Asset Management System · Asset Management System
1.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-43013
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-43013
Exploit
https://fluidattacks.com/advisories/nergal
Product
https://projectworlds.in/
More from Asset Management System
8.8
CVE-2023-43014
Asset Management System v1.0 - Authenticated SQL Injection (SQLi)