PT-2023-9130 · Qumagie · Qumagie

Published 2023-11-03 · Updated 2024-01-10 · CVE-2023-47219

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions QuMagie versions prior to 2.2.1

Description A SQL injection issue has been reported, potentially allowing authenticated users to inject malicious code via a network. This could be exploited by a remote attacker to execute arbitrary code. The vulnerability is related to the lack of protection measures for the SQL query structure.

Recommendations For versions prior to 2.2.1, update to QuMagie 2.2.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the SQL query functionality until the update is applied.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2024-03988

CVE-2023-47219

Affected Products

Qumagie

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-47219 · Security Note
• https://qnap.com/en/security-advisory/qsa-23-32 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-47219 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-03988 · Security Note
• https://vuldb.com/?id.249801 · Note
• https://twitter.com/VulmonFeeds/status/1743355897944948744 · Twitter Post