CVE-2023-26780

Vulnerability

CleverStupidDog yf-exam version 1.8.0, a multi-role online training and examination system, is vulnerable to SQL injection. The parameters passed to the application are not properly filtered, leading to SQL injection flaws [2]. The vulnerability is identified as CVE-2023-26780 [1].

Exploitation

An attacker can exploit this vulnerability by sending crafted input parameters to the application. No authentication or special privileges are mentioned in the available references; the injection occurs through unfiltered user-supplied data [2].

Impact

Successful exploitation could allow an attacker to execute arbitrary SQL commands, potentially leading to unauthorized access to the database, disclosure of sensitive information, or modification of data. The full extent of impact is not detailed in the references [2].

Mitigation

As of the publication date (2023-03-02), no official patch or mitigation has been disclosed in the available references. Users should monitor the vendor's repository for updates [1][2].