CVE-2023-34753

CRITICALNuclei

bloofoxCMS v0.5.2.1 - SQL Injection

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2023-34753 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the tid parameter at admin/index.php?mode=settings&page=tmpl&action=edit.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 2, 2025 · Source: CVE List

Nuclei templates

1
ProjectDiscoveryCRITICALbloofoxCMS v0.5.2.1 - SQL InjectionCVSS 9.8

bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the tid parameter at admin/index.php?mode=settings&page=tmpl&action=edit.

Impact

Authenticated attackers can exploit SQL injection through the tid parameter in the template settings page to extract database contents, manipulate CMS data, and potentially execute commands on the underlying database server.

Remediation

Update bloofoxCMS to a version newer than 0.5.2.1 that uses parameterized queries or prepared statements for the tid parameter in admin/index.php template editing functionality.

WeaknessesCWE-89
Authorstheamanrawat
Template tagstime-based-sqlicvecve2023sqlibloofoxauthenticatedvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:bloofox:bloofoxcms:0.5.2.1:*:*:*:*:*:*:*
FOFA: Powered by bloofoxCMS
FOFA: powered by bloofoxcms
https://www.bloofox.com/ https://ndmcyb.hashnode.dev/bloofox-v0521-was-discovered-to-contain-many-sql-injection-vulnerability https://nvd.nist.gov/vuln/detail/CVE-2023-34753

Source: ProjectDiscovery

References

2