CVE-2023-3208
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk49th percentile - higher than 49% of all known CVEs
Summary
A critical vulnerability has been found in RoadFlow Visual Process Engine .NET Core Mvc 2.13.3, affecting an unknown functionality of the file /Log/Query. Manipulation of the arguments sidx/sord leads to SQL injection, which can be exploited remotely.
Risk Assessment
This vulnerability poses a serious risk to organizations, allowing remote attackers to perform SQL injection attacks, potentially leading to data exposure or system compromise.
Recommendation
It is recommended to immediately update the component to the latest version to mitigate this vulnerability and to monitor the system for unauthorized activities.
Original NVD description (English source)
A vulnerability, which was classified as critical, has been found in RoadFlow Visual Process Engine .NET Core Mvc 2.13.3. Affected by this issue is some unknown functionality of the file /Log/Query?appid=0B736354-9473-4D66-B9C0-15CAC149EB05&tabid=tab_0B73635494734D66B9C015CAC149EB05 of the component Login. The manipulation of the argument sidx/sord leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-231230 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.