PT-2023-22633 · Unknown · Payatu Chatengine

Akshat Singhal · Published 2023-07-06 · Updated 2023-07-12 · CVE-2023-30323

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Payatu ChatEngine version 1.0

Description The issue allows attackers to gain sensitive information through a SQL Injection vulnerability in the username field, located in the /src/chatbotapp/chatWindow.java file.

Recommendations For Payatu ChatEngine version 1.0, consider restricting access to the chatWindow.java file or disabling the username field until a patch is available. Avoid using the username field in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2023-30323

Affected Products

Payatu Chatengine

References · 5

• https://osv.dev/vulnerability/CVE-2023-30323 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-30323 · Security Note
• https://github.com/wliang6/ChatEngine/blob/fded8e710ad59f816867ad47d7fc4862f6502f3e/src/chatbotapp/chatWindow.java#L34:L60 · Note
• https://payatu.com/advisory/sql-injection-in-chatwindow-functionality-in-chatengine-1-0 · Note
• https://t.me/cibsecurity/66122 · Telegram Post