esiclivre SQL Injection Vulnerability in Password Reset Function

A SQL injection vulnerability has been identified in the password reset function of esiclivre versions through v0.2.2. This vulnerability allows unauthenticated remote attackers to inject SQL via the 'cpfcnpj' parameter in the '/reset/index.php' endpoint, potentially leading to unauthorized access to sensitive information from the database.

Impact

Exploitation of this vulnerability could result in unauthorized access to sensitive database information.

Remediation

No upstream fix is currently available. It is recommended to use parameterized queries for database access, validate and sanitize user input, and consider temporarily restricting access to the password reset endpoint until a patch is applied.