Description
A vulnerability was found in kuaifan DooTask up to 1.2.49. Affected by this vulnerability is an unknown functionality of the file app/Http/Controllers/Api/UsersController.php. The manipulation of the argument keys[department] results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| kuaifan | DooTask | 1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.2.4, 1.2.5, 1.2.6, 1.2.7, 1.2.8, 1.2.9, 1.2.10, 1.2.11, 1.2.12, 1.2.13, 1.2.14, 1.2.15, 1.2.16, 1.2.17, 1.2.18, 1.2.19, 1.2.20, 1.2.21, 1.2.22, 1.2.23, 1.2.24, 1.2.25, 1.2.26, 1.2.27, 1.2.28, 1.2.29, 1.2.30, 1.2.31, 1.2.32, 1.2.33, 1.2.34, 1.2.35, 1.2.36, 1.2.37, 1.2.3… | — |
References
- VDB-325117 | kuaifan DooTask UsersController.php sql injection vdb-entry technical-description
- VDB-325117 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- Submit #646886 | kuaifan DooTask <= 1.2.49 SQL Injection third-party-advisory
- https://github.com/kuaifan/dootask/issues/283 issue-tracking
- https://github.com/kuaifan/dootask/issues/283#issue-3379188930 exploit issue-tracking