Описание
A post-authentication SQL injection vulnerability in Koollab LMS allowed an authenticated attacker to use an error-based SQL oracle via the face-to-face runs update endpoint to read the entire application database and obtain valid JWT tokens for account takeover.
EPSS
Процентиль: 17%
0.00252
Низкий
8.1 High
CVSS3
Дефекты
CWE-89
Связанные уязвимости
CVSS3: 8.1
github
13 дней назад
A post-authentication SQL injection vulnerability in Koollab LMS allowed an authenticated attacker to use an error-based SQL oracle via the face-to-face runs update endpoint to read the entire application database and obtain valid JWT tokens for account takeover.
EPSS
Процентиль: 17%
0.00252
Низкий
8.1 High
CVSS3
Дефекты
CWE-89