PT-2023-23322 · Evasys · Evasys

Bsc + 3 · Publicado 2023-05-02 · Atualizado 2023-05-09 · CVE-2023-31433

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions evasys versions prior to 8.2 Build 2286 evasys versions 9.x prior to 9.0 Build 2401

Description A SQL injection issue in Logbuch in evasys allows authenticated attackers to execute SQL statements via the welche parameter.

Recommendations For evasys versions prior to 8.2 Build 2286, update to version 8.2 Build 2286 or later. For evasys versions 9.x prior to 9.0 Build 2401, update to version 9.0 Build 2401 or later. As a temporary workaround, consider restricting access to the welche parameter to minimize the risk of exploitation.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2023-31433

Produtos afetados

Evasys

Referências · 5

• 🔥 https://cves.at/posts/cve-2023-31433/writeup · Exploit
• https://osv.dev/vulnerability/CVE-2023-31433 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-31433 · Nota de Segurança
• https://t.me/cibsecurity/63184 · Publicação no Telegram
• https://t.me/cvenotify/50087 · Publicação no Telegram