PT-2023-2986 · Oracle · Mysql Server

Oxeye-Daniel + 1 · Publicado 2023-04-25 · Atualizado 2023-06-07 · CVE-2023-33967

Positive Technologies (AI Summary)

CVSS v3.1

8.2

Alta

Vetor base

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions EaseProbe versions prior to 2.1.0

Description The issue is related to an SQL injection problem in EaseProbe when using MySQL/PostgreSQL data checking. This occurs due to a lack of protection measures for the SQL query structure, allowing an attacker to execute arbitrary SQL code. The vulnerability was discovered by the Oxeye research team.

Recommendations For versions prior to 2.1.0, upgrade to version 2.1.0 to resolve the issue. As a temporary workaround, consider restricting access to the MySQL/PostgreSQL data checking functionality until the upgrade is applied.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

BDU:2023-03010

CVE-2023-33967

GHSA-4C32-W6C7-77X4

Produtos afetados

Mysql Server

Referências · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/33xxx/CVE-2023-33967.json · Exploit
• https://github.com/megaease/easeprobe/pull/330 · Correção
• https://github.com/megaease/easeprobe/security/advisories/GHSA-4c32-w6c7-77x4 · Aviso do Fabricante
• https://github.com/megaease/easeprobe · Nota
• https://github.com/megaease/easeprobe/commit/caaf5860df2aaa76acd29bc40ec9a578d0b1d6e1%20https://github.com/megaease/easeprobe/pull/330%20https://github.com/megaease/easeprobe/security/advisories/GHSA-4c32-w6c7-77x4 · Nota
• https://github.com/megaease/easeprobe/commit/caaf5860df2aaa76acd29bc40ec9a578d0b1d6e1 · Correção
• https://github.com/megaease/easeprobe/releases/tag/v2.1.0 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-33967 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-4c32-w6c7-77x4 · Aviso do Fabricante
• https://tenable.com/cve/CVE-2023-33967 · Nota
• https://t.me/cibsecurity/64833 · Publicação no Telegram
• https://vuldb.com/?id.230396 · Nota
• https://bdu.fstec.ru/vul/2023-03010 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-33967 · Aviso do Fabricante