PT-2023-24960 · Unknown · Wifi Soft Unibox Administration

Ansh Jain + 1 · Publicado 2023-07-31 · Atualizado 2023-08-04 · CVE-2023-34635

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Wifi Soft Unibox Administration versions 3.0 through 3.1

Description The issue arises from the lack of validation or sanitization of user input in the username field of the login page, leading to SQL Injection. This allows attackers to inject malicious SQL code, potentially accessing or modifying sensitive data.

Recommendations For versions 3.0 and 3.1, consider disabling the login functionality until a patch is available, or restrict access to the login page to minimize the risk of exploitation. Avoid using the username field in the login page until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2023-34635

Produtos afetados

Wifi Soft Unibox Administration

Referências · 6

• 🔥 https://exploit-db.com/exploits/51610 · Exploit
• 🔥 http://packetstormsecurity.com/files/173669/Wifi-Soft-Unibox-Administration-3.0-3.1-SQL-Injection.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-34635 · Nota de Segurança
• https://t.me/cvenotify/55564 · Publicação no Telegram
• https://t.me/cibsecurity/67462 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-34635 · Aviso do Fabricante