by Kastro
Paper/Archive/CVE-2023-1091

CVE-2023-1091

Alpata Licensed Warehousing Automation System — SQL Injection found in ALPATA's Licensed Warehousing Automation System

EPSS 0.7%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (NVD, CNA agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 53.4.534 × 2010.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Alpata Licensed Warehousing Automation System allows Command Line Execution through SQL Injection. This issue affects Licensed Warehousing Automation System: through 2023.1.01.

Affected

ProductAffectedFixed inSource
Licensed Warehousing Automation System≤ 2023.1.01–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
TR-CERT (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refusom.gov.tr/bildirim/tr-23-0139refsiberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-23-0139