PT-2023-27875 · Plixer · Plixer Scrutinizer

Chris Bellows · Published 2023-10-12 · Updated 2023-10-16 · CVE-2023-41262

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Plixer Scrutinizer versions prior to 19.3.1

Description An issue was discovered in the /fcgi/scrut fcgi.fcgi endpoint, specifically in the csvExportReport endpoint action generateCSV, which is vulnerable to SQL injection through the sorting parameter. This allows an unauthenticated user to execute arbitrary SQL statements in the context of the application's backend database server.

Recommendations For versions prior to 19.3.1, update to version 19.3.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the /fcgi/scrut fcgi.fcgi endpoint or disabling the generateCSV action in the csvExportReport endpoint until a patch is available. Avoid using the sorting parameter in the affected endpoint until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2023-41262

Affected Products

Plixer Scrutinizer

References · 6

• 🔥 https://github.com/atredispartners/advisories/blob/master/ATREDIS-2023-0001.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-41262 · Security Note
• https://osv.dev/vulnerability/CVE-2023-41262 · Vendor Advisory
• https://t.me/cibsecurity/72212 · Telegram Post
• https://twitter.com/CVEnew/status/1712596663603224636 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1712625799537254662 · Twitter Post