CVE-2023-6414 — AI Deep Analysis Summary

🚨 **Essence**: Voovi 1.0 suffers from **SQL Injection** in `perfil.php`. 📉 **Consequences**: Full compromise of the database. Attackers can read, modify, or delete sensitive user data.…

🛡️ **Root Cause**: **CWE-89** (SQL Injection). The flaw lies in `perfil.php`. User input is not sanitized before being executed in SQL queries. This allows malicious SQL commands to bypass security controls.

👥 **Affected**: **Voovi Social Networking Script**. Specifically **Version 1.0**. It is an open-source social network script hosted on Sourceforge. Any instance running this specific version is at risk.

💀 **Attacker Capabilities**: With **CVSS 3.1 (High)** score, attackers have: 🔓 **Full Access**: Read all database contents. 📝 **Modify Data**: Change user profiles or system settings.…

🔓 **Exploitation Threshold**: **LOW**. 🚫 **No Auth Required**: PR:N (Privileges Required: None). 🌐 **Network Accessible**: AV:N (Attack Vector: Network). 🖱️ **No User Interaction**: UI:N (User Interaction: None).…

📜 **Public Exploit**: The provided data lists **empty PoCs** (`pocs: []`). However, the vulnerability is well-documented by Incibe CERT.…

🔍 **Self-Check**: Scan for `perfil.php` endpoints. Use SQL injection testing tools (e.g., sqlmap) against the profile page. Look for error messages revealing SQL syntax. Check if the script is the open-source Voovi v1.0.

🩹 **Official Fix**: The data does not list a specific patch commit. However, the vulnerability was disclosed by **Incibe CERT** on 2023-11-30.…

🛡️ **No Patch Workaround**: 1️⃣ **Disable** the `perfil.php` feature if possible. 2️⃣ **WAF**: Deploy Web Application Firewall rules to block SQL injection patterns.…

⚡ **Urgency**: **CRITICAL**. 🚨 **Priority**: Immediate action required. With **High** impact (C:H, I:H, A:H) and **Low** complexity, this is an easy target for automated bots.…