Description
OpenBiz Cubi Lite 3.0.8 contains a SQL injection vulnerability in the login form that allows unauthenticated attackers to manipulate database queries through the username parameter. Attackers can submit POST requests to /bin/controller.php with malicious SQL code in the username field to extract sensitive database information or bypass authentication.
CVSS 8.2EPSS 0.327%Risk 0.84
View source- Published
- 2026-03-26 12:16:06
- Affected versions
- <=3.0.8
- Type
- Package
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N