CVE-2023-3793
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
A critical vulnerability was found in Weaver e-cology, affecting unknown processing of the file filelFileDownloadForOutDoc.class in the HTTP POST Request Handler component. Manipulating the argument fileid with the input 1+WAITFOR+DELAY leads to SQL injection.
Risk Assessment
This vulnerability could allow attackers to execute unauthorized SQL queries, potentially leading to data exposure or system compromise. Organizations should treat this flaw as critical due to its potential consequences.
Recommendation
It is recommended to upgrade to version 10.58.0 to address this vulnerability. Additionally, other components of the system should be reviewed and secured.
Original NVD description (English source)
A vulnerability was found in Weaver e-cology. It has been rated as critical. This issue affects some unknown processing of the file filelFileDownloadForOutDoc.class of the component HTTP POST Request Handler. The manipulation of the argument fileid with the input 1+WAITFOR+DELAY leads to sql injection. Upgrading to version 10.58.0 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-235061 was assigned to this vulnerability.