by Kastro
Paper/Archive/CVE-2023-3522

CVE-2023-3522

a2 License Portal System — SQLi in a2 License Portal System

EPSS 0.6%CVSS 9.8
critical.is priorityof 100
39
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 49.8.498 × 2010.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in a2 License Portal System allows SQL Injection. This issue affects License Portal System: before 1.48.

Affected

ProductAffectedFixed inSource
License Portal System< 1.481.48CNA

Scores by source

TR-CERT (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refusom.gov.tr/bildirim/tr-23-0445refsiberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-23-0445