CVE-2023-53960

SOUND4 IMPACT/FIRST/PULSE/Eco v2.x SQL Injection via Authentication Bypass

CVSS 9.3 CRITICALEPSS 0.7%CWE-89

Vexday Risk Score

28Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 9.3EPSS 0.7%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

22 dic 2025Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

SOUND4 IMPACT/FIRST/PULSE/Eco version 2.x contains an SQL injection vulnerability in the 'index.php' authentication mechanism that allows attackers to manipulate login credentials. Attackers can inject malicious SQL code through the 'password' POST parameter to bypass authentication and potentially gain unauthorized access to the system.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Productos afectados

Kantar Media · WM2 SOUND4 Ltd. · BigVoice2 SOUND4 Ltd. · BigVoice4 SOUND4 Ltd. · Impact/Pulse Eco SOUND4 Ltd. · Impact/Pulse/First SOUND4 Ltd. · Stream

¿Quieres saber si tu infraestructura está expuesta a esto?

Hablar con TrueHacking →

Referencias

https://web.archive.org/web/20221207074555/https://www.sound4.com/https://www.exploit-db.com/exploits/51171 https://www.vulncheck.com/advisories/sound-impactfirstpulseeco-x-sql-injection-via-authentication-bypass https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5726.php