PT-2023-13359 · Sage · Sage Xrt Business Exchange

CVE-2022-34324 · Publicado 2023-01-01 · Atualizado 2025-04-11

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sage XRT Business Exchange version 12.4.302

Description The issue allows an authenticated attacker to inject malicious data in SQL queries, specifically in the following areas: Add Currencies, Payment Order, and Transfer History.

Recommendations For Sage XRT Business Exchange version 12.4.302, consider restricting access to the SQL queries in the affected areas until a patch is available. As a temporary workaround, avoid using the vulnerable queries in Add Currencies, Payment Order, and Transfer History. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2022-34324

Produtos afetados

Sage Xrt Business Exchange

Referências · 6

• 🔥 https://synacktiv.com/sites/default/files/2022-12/sage_xrt_multiple_sqli_1.pdf · Exploit
• https://t.me/cvenotify/41093 · Publicação no Telegram
• https://t.me/cibsecurity/55715 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2022-34324 · Nota de Segurança
• https://t.me/cvenotify/118850 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2022-34324 · Aviso do Fabricante