CVE-2023-5046

Critical

Published: 12/10/2023(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

CVE-2023-5046 describes an improper neutralization of special elements used in SQL commands, allowing SQL Injection and command execution through SQL Injection in Biltay Technology's Procost software.

Risk Assessment

An attacker could exploit this vulnerability to gain unauthorized access to the database and execute arbitrary system commands, potentially leading to serious security breaches for the organization.

Recommendation

It is recommended to update Procost software to version 1390 or later to mitigate this vulnerability and conduct a security audit of the application.

Original NVD description (English source)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Biltay Technology Procost allows SQL Injection, Command Line Execution through SQL Injection. This issue affects Procost: before 1390.