Description (CNA)
A vulnerability was found in kuaifan DooTask up to 1.2.49. Affected by this vulnerability is an unknown functionality of the file app/Http/Controllers/Api/UsersController.php. The manipulation of the argument keys[department] results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| kuaifan / DooTask | affected 1.2.0; affected 1.2.1; affected 1.2.2; affected 1.2.3; affected 1.2.4; affected 1.2.5; affected 1.2.6; affected 1.2.7; affected 1.2.8; affected 1.2.9; affected 1.2.10; affected 1.2.11; affected 1.2.12; affected 1.2.13; affected 1.2.14; affected 1.2.15; affected 1.2.16; affected 1.2.17; affected 1.2.18; affected 1.2.19; affected 1.2.20; affected 1.2.21; affected 1.2.22; affected 1.2.23; affected 1.2.24; affected 1.2.25; affected 1.2.26; affected 1.2.27; affected 1.2.28; affected 1.2.29; affected 1.2.30; affected 1.2.31; affected 1.2.32; affected 1.2.33; affected 1.2.34; affected 1.2.35; affected 1.2.36; affected 1.2.37; affected 1.2.38; affected 1.2.39; affected 1.2.40; affected 1.2.41; affected 1.2.42; affected 1.2.43; affected 1.2.44; affected 1.2.45; affected 1.2.46; affected 1.2.47; affected 1.2.48; affected 1.2.49 |
CWE
CWE-89, CWE-74
References
- https://vuldb.com/?id.325117
- https://vuldb.com/?ctiid.325117
- https://vuldb.com/?submit.646886
- https://github.com/kuaifan/dootask/issues/283
- https://github.com/kuaifan/dootask/issues/283#issue-3379188930
ADP enrichment
No English description supplied.
No references supplied.