CVE-2023-32754

Thinking Software Efence - SQL injection

CVSS 9.8 CRITICALEPSS 1.0%CWE-89

Vexday Risk Score

28Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 9.8EPSS 1.0%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

16 jun 2023Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

Thinking Software Efence login function has insufficient validation for user input. An unauthenticated remote attacker can exploit this vulnerability to inject arbitrary SQL commands to access, modify or delete database.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Productos afectados

Thinking Software · Efence

Referencias

https://www.twcert.org.tw/tw/cp-132-7161-3e7c9-1.html