Description
Multiple SQL injection vulnerabilities in Nicola Asuni TCExam before 11.3.009 allow remote authenticated users with level 5 or greater permissions to execute arbitrary SQL commands via the (1) user_groups[] parameter to admin/code/tce_edit_test.php or (2) subject_id parameter to admin/code/tce_show_all_questions.php.
Remediation
References
Related Vulnerabilities
Joomla Other Vulnerability (CVE-2023-23752)
LimeSurvey Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2018-1000658)
WordPress Plugin Social Auto Poster-WordPress Scheduler & Marketing Arbitrary File Upload (5.3.14)
Moodle Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2013-1835)
WordPress Plugin Limit Attempts by BestWebSoft SQL Injection (1.1.0)