PT-2023-30444 · Ibos Oa · Ibos Oa

Wudidike · Publicado 2023-09-03 · Atualizado 2024-05-17 · CVE-2023-4741

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IBOS OA version 4.5.5

Description A critical issue has been found in the Delete Logs Handler component, specifically affecting the file ?r=diary/default/del. This issue leads to sql injection and can be initiated remotely. The manipulation of unknown code in this component is the cause of the problem.

Recommendations For IBOS OA version 4.5.5, consider restricting access to the ?r=diary/default/del file until a patch is available. As a temporary workaround, avoid using the Delete Logs Handler component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2023-4741

Produtos afetados

Ibos Oa

Referências · 7

• 🔥 https://github.com/wudidike/cve/blob/main/sql.md · Exploit
• https://vuldb.com/?ctiid.238630 · Nota
• https://twitter.com/CVEnew/status/1698459208104943722 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-4741 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/1698496248272093385 · Publicação no Twitter
• https://vuldb.com/?id.238630 · Nota
• https://osv.dev/vulnerability/CVE-2023-4741 · Aviso do Fabricante