CVE-2023-4987

HighCVSS 8.0/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as critical, has been found in infinitietech taskhub 2.8.7. Affected by this issue is some unknown functionality of the file /home/get_tasks_list of the component GET Parameter Handler. The manipulation of the argument project/status/user_id/sort/search leads to sql injection. VDB-239798 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
infinitietech	taskhub	2.8.7

References

http://packetstormsecurity.com/files/174760/Taskhub-2.8.7-SQL-Injection.htmlExploit, Third Party Advisory, VDB Entry
https://vuldb.com/?ctiid.239798Third Party Advisory
https://vuldb.com/?id.239798Third Party Advisory
http://packetstormsecurity.com/files/174760/Taskhub-2.8.7-SQL-Injection.htmlExploit, Third Party Advisory, VDB Entry
https://vuldb.com/?ctiid.239798Third Party Advisory
https://vuldb.com/?id.239798Third Party Advisory

Timeline

Published: Sep 15, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-498744.3Mattermost fails to check whether a user is a guest when updating the tasks of a private playbook run allowing a guest to update the tasks o CVE-2023-498774.3IBM System Storage Virtualization Engine TS7700 3957-VEC, 3948-VED and 3957-VEC could allow a remote authenticated user to obtain sensitive CVE-2023-498784.3IBM System Storage Virtualization Engine TS7700 3957-VEC, 3948-VED and 3957-VEC could allow a remote attacker to obtain sensitive informatio CVE-2023-49889.8A vulnerability, which was classified as problematic, was found in Bettershop LaikeTui. This affects an unknown part of the file index.php?m CVE-2023-498807.5In the Message Entry and Repair (MER) facility of IBM Financial Transaction Manager for SWIFT Services 3.2.4 the sending address and the mes CVE-2023-498818.8IBM Transformation Extender Advanced 10.0.1 does not invalidate session after logout which could allow an authenticated user to impersonat CVE-2023-498837.5IBM Transformation Extender Advanced 10.0.1 does not require that users should have strong passwords by default, which makes it easier CVE-2023-498869.8IBM Standards Processing Engine 10.0.1.10 could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe java de CVE-2023-498978.8An OS command injection vulnerability exists in AE1021PE firmware version 2.0.9 and earlier and AE1021 firmware version 2.0.9 and earlier. I CVE-2023-498987.2In streampark, there is a project module that integrates Maven's compilation capability. However, there is no check on the compilation param CVE-2023-498999.8An unauthenticated remote attacker can execute any command on the affected device due to not correctly verifying the origin of a communicati CVE-2023-49907.5Directory traversal vulnerability in MCL-Net versions prior to 4.6 Update Package (P01) may allow attackers to read arbitrary files.