vendor:
Ovidentia
by:
Felipe Prates Donato (m4ud)
8.8
CVSS
HIGH
SQL Injection
89
CWE
Product Name: Ovidentia
Affected Version From: 6
Affected Version To: 6
Patch Exists: No
Related CWE: N/A
CPE: ovidentia:ovidentia:6
Metasploit:
N/A
Other Scripts:
N/A
Platforms Tested: None
2020
Ovidentia 6 – ‘id’ SQL injection (Authenticated)
This exploit allows an authenticated user to inject arbitrary SQL commands into the 'id' parameter of the 'index.php' page of Ovidentia 6. By exploiting this vulnerability, an attacker can gain access to the database and extract sensitive information.
Mitigation:
To mitigate this vulnerability, the application should use parameterized queries and input validation.
