CVE-2023-3801
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
A critical vulnerability was found in IBOS OA 4.5.5, affecting the actionEdit function of the file ?r=officialdoc/officialdoc/edit of the Mobile Notification Handler component. Manipulation of this function leads to SQL injection.
Risk Assessment
This vulnerability could be exploited by attackers to gain control over the database, posing a serious threat to the organization's data security.
Recommendation
It is recommended to immediately update the IBOS OA software to the latest version to eliminate this vulnerability and to monitor the system for unauthorized activities.
Original NVD description (English source)
A vulnerability was found in IBOS OA 4.5.5. It has been declared as critical. Affected by this vulnerability is the function actionEdit of the file ?r=officialdoc/officialdoc/edit of the component Mobile Notification Handler. The manipulation leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier VDB-235069 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.