PT-2023-27875 · Plixer · Plixer Scrutinizer

Chris Bellows · Publicado 2023-10-12 · Atualizado 2023-10-16 · CVE-2023-41262

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Plixer Scrutinizer versions prior to 19.3.1

Description An issue was discovered in the /fcgi/scrut fcgi.fcgi endpoint, specifically in the csvExportReport endpoint action generateCSV, which is vulnerable to SQL injection through the sorting parameter. This allows an unauthenticated user to execute arbitrary SQL statements in the context of the application's backend database server.

Recommendations For versions prior to 19.3.1, update to version 19.3.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the /fcgi/scrut fcgi.fcgi endpoint or disabling the generateCSV action in the csvExportReport endpoint until a patch is available. Avoid using the sorting parameter in the affected endpoint until the issue is resolved.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2023-41262

Produtos afetados

Plixer Scrutinizer

Referências · 6

• 🔥 https://github.com/atredispartners/advisories/blob/master/ATREDIS-2023-0001.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-41262 · Nota de Segurança
• https://t.me/cibsecurity/72212 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1712596663603224636 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-41262 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1712625799537254662 · Publicação no Twitter