CVE-2023-34752

CriticalCVSS 9.8

Published: 14/06/2023(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

4.38%

90th percentile - higher than 90% of all known CVEs

Summary

A SQL injection vulnerability was discovered in bloofox v0.5.2.1 via the lid parameter in admin/index.php. An attacker can exploit this flaw to manipulate database queries.

Risk Assessment

The risk involves unauthorized database access, potentially leading to leakage, modification, or deletion of sensitive organizational data.

Recommendation

Immediately update bloofox to the latest available version and implement input validation and sanitization for the lid parameter.

Other vulnerabilities in bloofox

See all

CVE-2023-34756Critical
Version 0.5.2.1 of the bloofox application was found to contain a SQL injection vulnerability via the cid parameter in admin/index.php?mode=settings&page=charset&action=edit.
CVE-2023-34755Critical
Version 0.5.2.1 of the bloofox application was found to contain a SQL injection vulnerability via the userid parameter in admin/index.php?mode=user&action=edit.
CVE-2023-34754Critical
Version 0.5.2.1 of bloofox was found to contain a SQL injection vulnerability via the pid parameter in admin/index.php?mode=settings&page=plugins&action=edit.
CVE-2023-34753Critical
Version 0.5.2.1 of bloofox was found to contain a SQL injection vulnerability via the tid parameter in admin/index.php?mode=settings&page=tmpl&action=edit.
CVE-2023-34751Critical
Version 0.5.2.1 of bloofox was found to contain a SQL injection vulnerability via the gid parameter in admin/index.php?mode=user&page=groups&action=edit.
CVE-2023-34750Critical
Version 0.5.2.1 of bloofox was found to contain a SQL injection vulnerability via the cid parameter in admin/index.php?mode=settings&page=projects&action=edit.
CVE-2023-27812Critical
In bloofox v0.5.2, an arbitrary file deletion vulnerability was discovered via the delete_file() function. An attacker can exploit this flaw to delete critical system files.

Original NVD description (English source)

bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the lid parameter at admin/index.php?mode=settings&page=lang&action=edit.