CVE-2023-34756

CRITICALNuclei

Bloofox v0.5.2.1 - SQL Injection

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2023-34756 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the cid parameter at admin/index.php?mode=settings&page=charset&action=edit.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 3, 2025 · Source: CVE List

Nuclei templates

1
ProjectDiscoveryCRITICALBloofox v0.5.2.1 - SQL InjectionCVSS 9.8

Bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the cid parameter at admin/index.php?mode=settings&page=charset&action=edit.

Impact

Authenticated attackers can exploit time-based SQL injection in the cid parameter to extract sensitive database information including user credentials and CMS configuration data from the Bloofox system.

Remediation

Update Bloofox to a version newer than 0.5.2.1 that uses parameterized queries and properly validates the cid parameter in the charset settings.

WeaknessesCWE-89
Authorstheamanrawat
Template tagstime-based-sqlicvecve2023sqlibloofoxauthenticatedvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:bloofox:bloofoxcms:0.5.2.1:*:*:*:*:*:*:*
FOFA: Powered by bloofoxCMS
FOFA: powered by bloofoxcms
https://ndmcyb.hashnode.dev/bloofox-v0521-was-discovered-to-contain-many-sql-injection-vulnerability https://www.bloofox.com/ https://nvd.nist.gov/vuln/detail/CVE-2023-34756

Source: ProjectDiscovery

References

2