What’s Vulnerable › Vulnerabilities

CVE-2023-53982: PMB 7.4.6 SQL Injection Vulnerability via Unsanitized id Parameter

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-12-23 · updated 2026-10-29
• Weakness: CWE-89

Description

PMB 7.4.6 contains a SQL injection vulnerability in the id parameter of the storage module (categ=storage) of the opac_css/ajax.php endpoint that allows remote attackers to manipulate database queries. Attackers can exploit the unsanitized 'id' parameter by injecting conditional sleep statements to extract information or perform time-based blind SQL injection attacks.

Affected products

• SIGB PMB: 7.4.6 (and their updates)
• SIGB PMB: 7.4.6

References

• http://forge.sigb.net/redmine/projects/pmb/files
• http://www.sigb.net
• https://www.exploit-db.com/exploits/51197
• https://www.vulncheck.com/advisories/pmb-sql-injection-vulnerability-via-unsanitized-storage-parameter

Get alerted when CVE-2023-53982 or the next vulnerability affects your stack