PT-2023-2986 · Oracle · Mysql Server

Oxeye-Daniel + 1 · Published 2023-04-25 · Updated 2023-06-07 · CVE-2023-33967

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions EaseProbe versions prior to 2.1.0

Description The issue is related to an SQL injection problem in EaseProbe when using MySQL/PostgreSQL data checking. This occurs due to a lack of protection measures for the SQL query structure, allowing an attacker to execute arbitrary SQL code. The vulnerability was discovered by the Oxeye research team.

Recommendations For versions prior to 2.1.0, upgrade to version 2.1.0 to resolve the issue. As a temporary workaround, consider restricting access to the MySQL/PostgreSQL data checking functionality until the upgrade is applied.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2023-03010

CVE-2023-33967

GHSA-4C32-W6C7-77X4

Affected Products

Mysql Server

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/33xxx/CVE-2023-33967.json · Exploit
• https://github.com/megaease/easeprobe/pull/330 · Patch
• https://github.com/megaease/easeprobe/security/advisories/GHSA-4c32-w6c7-77x4 · Vendor Advisory
• https://github.com/megaease/easeprobe/commit/caaf5860df2aaa76acd29bc40ec9a578d0b1d6e1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-33967 · Security Note
• https://osv.dev/vulnerability/GHSA-4c32-w6c7-77x4 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-03010 · Security Note
• https://osv.dev/vulnerability/CVE-2023-33967 · Vendor Advisory
• https://github.com/megaease/easeprobe · Note
• https://github.com/megaease/easeprobe/commit/caaf5860df2aaa76acd29bc40ec9a578d0b1d6e1%20https://github.com/megaease/easeprobe/pull/330%20https://github.com/megaease/easeprobe/security/advisories/GHSA-4c32-w6c7-77x4 · Note
• https://github.com/megaease/easeprobe/releases/tag/v2.1.0 · Note
• https://tenable.com/cve/CVE-2023-33967 · Note
• https://t.me/cibsecurity/64833 · Telegram Post
• https://vuldb.com/?id.230396 · Note