Thinking Software Efence login function has insufficient validation for user input. An unauthenticated remote attacker can exploit this vulnerability to inject arbitrary SQL commands to access, modify or delete database.
References
| Link | Resource |
|---|---|
| https://www.twcert.org.tw/tw/cp-132-7161-3e7c9-1.html | Third Party Advisory |
| https://www.twcert.org.tw/tw/cp-132-7161-3e7c9-1.html | Third Party Advisory |
Configurations
History
21 Nov 2024, 08:03
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://www.twcert.org.tw/tw/cp-132-7161-3e7c9-1.html - Third Party Advisory |
30 Jun 2023, 07:38
| Type | Values Removed | Values Added |
|---|---|---|
| References | (CONFIRM) https://www.twcert.org.tw/tw/cp-132-7161-3e7c9-1.html - Third Party Advisory | |
| CPE | cpe:2.3:a:thinkingsoftware:efence:1.2.59:db_36:*:*:*:*:*:* |
16 Jun 2023, 04:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-06-16 04:15
Updated : 2024-11-21 08:03
NVD link : CVE-2023-32754
Mitre link : CVE-2023-32754
CVE.ORG link : CVE-2023-32754
JSON object : View
Products Affected
thinkingsoftware
- efence
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')