CVE-2023-7146

CVE-2023-7146 is a critical SQL injection vulnerability affecting gopeak MasterLab up to version 3.3.10. Specifically, the flaw resides in the sqlInjectDelete function within the Feature.php file, allowing an attacker to manipulate the 'phone' argument in an HTTP POST request. This vulnerability carries a CVSS score of 9.8 (Critical), indicating it can be exploited remotely with low complexity, leading to high impact on confidentiality, integrity, and availability. While there is no evidence of active exploitation in the wild or public exploit code like Metasploit or ExploitDB, the exploit has been publicly disclosed, and the vulnerability has garnered significant community discussion.