PT-2023-9083 · 3Cx · 3Cx

Published 2023-10-11 · Updated 2024-01-03 · CVE-2023-49954

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions 3CX versions prior to 18.0.9.23 3CX versions 20 prior to 20.0.0.1494

Description The issue is related to a SQL Injection vulnerability in the CRM Integration of 3CX. This vulnerability can be exploited via a first name, search string, or email address, allowing a remote attacker to execute arbitrary SQL queries. The vulnerability is due to the lack of protection of the SQL query structure.

Recommendations For 3CX versions prior to 18.0.9.23, update to version 18.0.9.23 or later to resolve the issue. For 3CX versions 20 prior to 20.0.0.1494, update to version 20.0.0.1494 or later to resolve the issue. As a temporary workaround, consider disabling the SQL Database Integrations to minimize the risk of exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2024-03502

CVE-2023-49954

Affected Products

3Cx

References · 13

• https://bdu.fstec.ru/vul/2024-03502 · Security Note
• https://osv.dev/vulnerability/CVE-2023-49954 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-49954 · Security Note
• https://t.me/pentestingnews/42112 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2023121827 · Note
• https://twitter.com/VulmonFeeds/status/1739247497543819644 · Twitter Post
• https://twitter.com/fridaysecurity/status/1735947510173049322 · Twitter Post
• https://t.me/cvenotify/65108 · Telegram Post
• https://cve-2023-49954.github.io · Note
• https://twitter.com/fletch_ai/status/1736931909689606264 · Twitter Post
• https://t.me/cybersecuritytechnologies/9594 · Telegram Post
• https://twitter.com/gbhackers_news/status/1736945852122571201 · Twitter Post
• https://t.me/freedomf0x/20785 · Telegram Post