CVE Vulnerability

CVE-2022-42923

Forma LMS on its 3.1.0 version and earlier is vulnerable to a SQL injection vulnerability. The exploitation of this vulnerability could allow an authenticated attacker (with the role of student) to perform a SQL injection on the 'id' parameter in the 'appCore/index.php?r=adm/mediagallery/delete' function in order to dump the entire database or delete all contents from the 'core_user_file' table.

8.8 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://www.incibe-cert.es/en/early-warning/security-advisories/multiple-vulnerabilities-forma-lms Patch Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:formalms:formalms:*:*:*:*:*:*:*:*
Information

Published : 2022-10-31 08:15

Updated : 2022-11-01 08:06

NVD link : CVE-2022-42923

Mitre link : CVE-2022-42923

Products Affected
No products.
CWE
CWE-89