CVE-2016-9048

CVE-2016-9048 describes multiple SQL Injection vulnerabilities in ProcessMaker Enterprise Core version 3.0.1.7-community. An attacker can exploit these vulnerabilities by sending specially crafted web requests, leading to potential exfiltration of database contents, user credentials, and in some configurations, access to the underlying operating system. This vulnerability carries a CVSS score of 7.4 (High), indicating a network-based attack with low complexity and requiring low privileges, but with a high impact on confidentiality, integrity, and availability. There is no evidence of active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this CVE.