CVE-2023-34752

CRITICALNuclei

bloofoxCMS v0.5.2.1 - SQL Injection

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2023-34752 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the lid parameter at admin/index.php?mode=settings&page=lang&action=edit.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 2, 2025 · Source: CVE List

Nuclei templates

1
ProjectDiscoveryCRITICALbloofoxCMS v0.5.2.1 - SQL InjectionCVSS 9.8

bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the lid parameter at admin/index.php?mode=settings&page=lang&action=edit.

Impact

Authenticated attackers can exploit SQL injection through the lid parameter in language settings to extract database contents, manipulate CMS data, and potentially execute commands on the underlying database server.

Remediation

Update bloofoxCMS to a version newer than 0.5.2.1 that uses parameterized queries or prepared statements for the lid parameter in admin/index.php language editing functionality.

WeaknessesCWE-89
Authorstheamanrawat
Template tagstime-based-sqlicvecve2023sqlibloofoxauthenticatedvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:bloofox:bloofoxcms:0.5.2.1:*:*:*:*:*:*:*
FOFA: Powered by bloofoxCMS
FOFA: powered by bloofoxcms
https://www.bloofox.com/ https://ndmcyb.hashnode.dev/bloofox-v0521-was-discovered-to-contain-many-sql-injection-vulnerability https://nvd.nist.gov/vuln/detail/CVE-2023-34752 http://bloofoxcms.com/ https://www.bloofox.com/

Source: ProjectDiscovery

References

4