CVE-2023-34755

CRITICALNuclei

bloofoxCMS v0.5.2.1 - SQL Injection

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2023-34755 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the userid parameter at admin/index.php?mode=user&action=edit.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 3, 2025 · Source: CVE List

Nuclei templates

1
ProjectDiscoveryCRITICALbloofoxCMS v0.5.2.1 - SQL InjectionCVSS 9.8

bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the userid parameter at admin/index.php?mode=user&action=edit.

Impact

Authenticated attackers can exploit SQL injection through the userid parameter in user management to extract database contents, manipulate user accounts, and potentially gain administrator access to the bloofoxCMS system.

Remediation

Update bloofoxCMS to a version newer than 0.5.2.1 that uses parameterized queries or prepared statements for the userid parameter in admin/index.php user editing functionality.

WeaknessesCWE-89
Authorstheamanrawat
Template tagstime-based-sqlicvecve2023sqlibloofoxauthenticatedvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:bloofox:bloofoxcms:0.5.2.1:*:*:*:*:*:*:*
FOFA: Powered by bloofoxCMS
FOFA: powered by bloofoxcms
https://www.bloofox.com/ https://ndmcyb.hashnode.dev/bloofox-v0521-was-discovered-to-contain-many-sql-injection-vulnerability https://nvd.nist.gov/vuln/detail/CVE-2023-34755

Source: ProjectDiscovery

References

2