Paper/Archive/CVE-2023-0939

CVE-2023-0939

NTN Information Technologies Online Services Software — Multiple SQL Injection on NTN Information Technologies' Online Services software

EPSS 0.7%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD, CNA agree)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 51.4.514 × 2010.3 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NTN Information Technologies Online Services Software allows SQL Injection. This issue affects Online Services Software: before 1.17.

Affected

ProductAffectedFixed inSource

Online Services Software< 1.171.17CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

TR-CERT (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refusom.gov.tr/bildirim/tr-23-0103 refsiberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-23-0103