WebChess 1.0 allows SQL injection via the messageFrom, gameID, opponent, messageID, or to parameter.

Published Jul 7, 2020 · Updated Aug 5, 2024 · Assigned by mitre