Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.3
CVE-2023-7145: gopeak MasterLab HTTP POST Request Framework.php sqlInject sql injection
CVE-2023-7145 · published 2 years ago
Summary
A vulnerability classified as critical was found in gopeak MasterLab up to 3.3.10. This vulnerability affects the function sqlInject of the file app/ctrl/Framework.php of the component HTTP POST Request Handler. The manipulation of the argument pwd leads to sql injection. The exploit has been disclo...
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| masterlab | masterlab |
<= 3.3.10 cpe:2.3:a:masterlab:masterlab:*:*:*:*:*:*:*:* |
Original advisory text
gopeak MasterLab HTTP POST Request Framework.php sqlInject sql injection
A vulnerability classified as critical was found in gopeak MasterLab up to 3.3.10. This vulnerability affects the function sqlInject of the file app/ctrl/Framework.php of the component HTTP POST Request Handler. The manipulation of the argument pwd leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249148.
References
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/7xxx/CVE-2023-7145.j... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-7145 Vendor Advisory
- https://vuldb.com/?id.249148 Vendor Advisory
- https://vuldb.com/?ctiid.249148 Third Party Advisory
- https://note.zhaoj.in/share/LEbo1ypfzfQh Exploit
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Severity
6.3
Medium
Type
CWE-89SQL Injection
Timeline
Published29 Dec 2023
Updated4 Nov 2026
First seen29 Sep 2026
Track software like this
Free during beta