CVE-2023-43013 CRITICAL

CVE-2023-43013: Asset Management System v1.0 - Unauthenticated SQL Injection (SQLi)

Vendor Asset Management System

Product Asset Management System

Weakness CWE-89 · SQLi

Published September 28, 2023

Last update September 23, 2024

View on NVD All CVEs

CVSS base score

9.8/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Asset Management System v1.0 is vulnerable to an unauthenticated SQL Injection vulnerability on the 'email' parameter of index.php page, allowing an external attacker to dump all the contents of the database contents and bypass the login control.

Key dates

02Disclosure timeline

September 28, 2023 CVE published

September 23, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-43013 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/89.html

Related vulnerabilities

04Related CVE

CVE-2025-7670 JS Archive List <= 6.1.5 - Unauthenticated SQL Injection via build_sql_where Function CVE-2026-34717 OpenProject: SQL Injection in Cost Reporting =n Operator via parse_number_string CVE-2025-8960 Campcodes Online Flight Booking Management System save_airlines.php sql injection CVE-2025-0229 code-projects Travel Management System enquiry.php sql injection CVE-2025-58789 WordPress WP Full Stripe Free Plugin <= 8.2.5 - SQL Injection Vulnerability