CVE-2023-33367
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk60th percentile - higher than 60% of all known CVEs
Summary
A SQL injection vulnerability exists in Control ID IDSecure 4.7.26.0 and prior, allowing unauthenticated attackers to write PHP files on the server's root directory, resulting in remote code execution.
Risk Assessment
This vulnerability poses a serious security risk, allowing attackers to remotely execute code on the server, potentially leading to data loss or system takeover.
Recommendation
It is recommended to update Control ID IDSecure to the latest version to mitigate this vulnerability and implement additional security measures such as log monitoring and restricting access to critical resources.
Original NVD description (English source)
A SQL injection vulnerability exists in Control ID IDSecure 4.7.26.0 and prior, allowing unauthenticated attackers to write PHP files on the server's root directory, resulting in remote code execution.