SQL Injection Vulnerability in IDURAR ERP/CRM by G37SYS73M
CVE-2023-27742

9.8CRITICAL

Key Information:

Vendor

Idurar Project

Status
Idurar
Vendor
CVE Published:
16 May 2023

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2023-27742?

A SQL injection vulnerability has been identified in the IDURAR ERP/CRM v1, allowing attackers to exploit the /api/login component. This could enable unauthorized access to sensitive data and manipulation of the back-end database, posing significant risks to the integrity and confidentiality of the system. It is crucial for users and administrators to evaluate their current security measures and apply necessary updates to mitigate this threat.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2023-27742
Created by G37SYS73M

References

https://github.com/G37SYS73M/CVE-2023-27742

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability Reserved

.