CVE-2023-22900

Thinking Software Technology Co., Ltd. Efence - SQL Injection

CVSS 9.8 CRITICALEPSS 1.0%CWE-89

Vexday Risk Score

28Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 9.8EPSS 1.0%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

31 Jan 2023Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

Efence login function has insufficient validation for user input. An unauthenticated remote attacker can exploit this vulnerability to inject arbitrary SQL commands to access, modify or delete database.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Thinking Software Technology Co., Ltd. · Efence

References

https://www.twcert.org.tw/tw/cp-132-6885-d679e-1.html