CVE-2023-39807

CriticalCVSS 9.8

Published: 21/08/2023(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.52%

40th percentile - higher than 40% of all known CVEs

Summary

A SQL injection vulnerability was discovered in iBSG v3.5 by N.V.K.INTER CO., LTD. (NVK) via the a_passwd parameter at /portal/user-register.php. This flaw allows an attacker to manipulate database queries.

Risk Assessment

The risk involves unauthorized access to database contents, potential data modification or deletion, compromising the confidentiality and integrity of the system.

Recommendation

Immediately update iBSG to the latest version and implement proper input validation and parameterized SQL queries.

Other vulnerabilities in iBSG

See all

CVE-2023-39809Critical
An OS command injection vulnerability was discovered in iBSG v3.5 by N.V.K.INTER CO., LTD. (NVK). The flaw exists in the system_hostname parameter at /manage/network-basic.php, allowing shell metacharacters to be injected.
CVE-2023-39808Critical
A hardcoded root password was discovered in N.V.K.INTER CO., LTD. (NVK) iBSG v3.5. This allows attackers to log in with root privileges via SSH.

Original NVD description (English source)

N.V.K.INTER CO., LTD. (NVK) iBSG v3.5 was discovered to contain a SQL injection vulnerability via the a_passwd parameter at /portal/user-register.php.