CVE-2023-48901

A SQL injection vulnerability in tramyardg Autoexpress version 1.3.0, allows remote unauthenticated attackers to execute arbitrary SQL commands via the parameter "id" within the getPhotosByCarId function call in details.php.

Score

CVSS 3.1 9.8 Critical

Status

Analyzed - cve@mitre.org

Published

2024-03-21

Last modified

2024-08-06

Weaknesses

CWE-89

Affected products

• Autoexpress (Tramyardg)

References

• https://packetstormsecurity.com/files/177660/Tramyardg-Autoexpress-1.3.0-SQL-Injection.html