CVE-2023-6413: SQL Injection in Voovi Social Networking Script

The SQL injection vulnerability in Voovi Social Networking Script allows an attacker to directly interact with the underlying database. By crafting malicious SQL queries through the photos.php script's id and user parameters, an attacker can bypass authentication and authorization mechanisms. This could result in the extraction of sensitive user data, including usernames, passwords, email addresses, and potentially even financial information if the script handles such data. Furthermore, an attacker could modify or delete data within the database, leading to data corruption or denial of service. The potential blast radius is significant, impacting all users of the vulnerable script and potentially exposing the entire database to compromise.

1. Reserved2023-11-30
2. Published2023-11-30
3. Modified2024-08-02
4. EPSS updated2026-04-02

The primary mitigation for CVE-2023-6413 is to immediately upgrade to version 1.0.1 of Voovi Social Networking Script. If upgrading is not immediately feasible due to compatibility issues or downtime concerns, consider implementing temporary workarounds. These might include input validation and sanitization on the id and user parameters within the photos.php script to prevent SQL injection attempts. Web application firewalls (WAFs) can also be configured to detect and block malicious SQL injection patterns targeting the photos.php endpoint. After upgrading, confirm the vulnerability is resolved by attempting a SQL injection attack via the photos.php script with a known malicious payload; the script should properly sanitize the input and prevent the query from executing.