CVE-2023-32754

Thinking Software Efence - SQL injection

State: Published
Severity: 9.8 Critical
Published: Jun 16, 2023
Updated: Dec 12, 2024
Reserved: May 15, 2023

Description

Thinking Software Efence login function has insufficient validation for user input. An unauthenticated remote attacker can exploit this vulnerability to inject arbitrary SQL commands to access, modify or delete database.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	twcert

Weaknesses

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Affected Products

Product	Versions
EfenceThinking Software	1.2.59 DB.ver 36Affected

References

https://www.twcert.org.tw/tw/cp-132-7161-3e7c9-1.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.