PT-2023-30444 · Ibos Oa · Ibos Oa

Wudidike · Published 2023-09-03 · Updated 2024-05-17 · CVE-2023-4741

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IBOS OA version 4.5.5

Description A critical issue has been found in the Delete Logs Handler component, specifically affecting the file ?r=diary/default/del. This issue leads to sql injection and can be initiated remotely. The manipulation of unknown code in this component is the cause of the problem.

Recommendations For IBOS OA version 4.5.5, consider restricting access to the ?r=diary/default/del file until a patch is available. As a temporary workaround, avoid using the Delete Logs Handler component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2023-4741

Affected Products

Ibos Oa

References · 7

• 🔥 https://github.com/wudidike/cve/blob/main/sql.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-4741 · Security Note
• https://osv.dev/vulnerability/CVE-2023-4741 · Vendor Advisory
• https://vuldb.com/?ctiid.238630 · Note
• https://twitter.com/CVEnew/status/1698459208104943722 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1698496248272093385 · Twitter Post
• https://vuldb.com/?id.238630 · Note