CVE-2023-27167

MediumCVSS 6.5

Published: 29/03/2023(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

7.50%

94th percentile - higher than 94% of all known CVEs

Summary

Suprema BioStar 2 v2.8.16 was discovered to contain a SQL injection vulnerability via the 'values' parameter at /users/absence?search_month=1. An attacker can exploit this flaw to manipulate database queries.

Risk Assessment

The risk includes unauthorized access to user data, modification or deletion of database records, potentially compromising the confidentiality and integrity of the access control system.

Recommendation

Immediately update Suprema BioStar 2 to the latest available version and implement parameterized SQL queries to eliminate the SQL injection vulnerability.

Original NVD description (English source)

Suprema BioStar 2 v2.8.16 was discovered to contain a SQL injection vulnerability via the values parameter at /users/absence?search_month=1.