Multiple SQL Injection Vulnerabilities in Sage XRT Business Exchange by Sage
CVE-2022-34324

8.8HIGH

Key Information:

Vendor

Sage

Status
Sage Xrt Business Exchange
Vendor
CVE Published:
1 January 2023

What is CVE-2022-34324?

Sage XRT Business Exchange version 12.4.302 contains multiple SQL injection vulnerabilities that can be exploited by authenticated attackers. These vulnerabilities allow the injection of malicious SQL code, potentially compromising the integrity of data during operations such as adding currencies, processing payment orders, and retrieving transfer history. It is crucial for organizations utilizing this software to address these vulnerabilities promptly to ensure their data remains secure.

References

https://www.synacktiv.com/sites/default/files/2022-12/sag...

EPSS Score

11% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.