CVE-2023-32754

Thinking Software Efence - SQL injection

CVSS 9.8 CRITICALEPSS 1.0%CWE-89

Vexday Risk Score

28Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 9.8EPSS 1.0%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

16 Jun 2023Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

Thinking Software Efence login function has insufficient validation for user input. An unauthenticated remote attacker can exploit this vulnerability to inject arbitrary SQL commands to access, modify or delete database.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Thinking Software · Efence

References

https://www.twcert.org.tw/tw/cp-132-7161-3e7c9-1.html