by Kastro
Paper/Archive/CVE-2023-6097

CVE-2023-6097

ICSSolution ICS Business Manager — SQL Injection on ICSSolution ICS Business Manager

EPSS 0.8%CVSS 9.4
critical.is priorityof 100
40
CVSS 9.4 (CNA)9.4 / 10 × 3028.2Not in CISA KEV+300.0EPSS percentile 56.7.567 × 2011.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A SQL injection vulnerability has been found in ICS Business Manager, affecting version 7.06.0028.7089. This vulnerability could allow a remote user to send a specially crafted SQL query and retrieve all the information stored in the database. The data could also be modified or deleted, causing the application to malfunction.

Affected

ProductAffectedFixed inSource
ICS Business Manager7.06.0028.7089–CNA
ICS Business Manager7.06.0028.7066–CNA
ICS Business Manager7.06.0028.2802–CNA
ics_business_manager7.06.0028.7089–CISA-ADP
ics_business_manager7.06.0028.7066–CISA-ADP
ics_business_manager7.06.0028.2802–CISA-ADP

Scores by source

INCIBE (CNA)9.4CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refincibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-icssolution-ics-business-manager