Use of Cleartext credentials in Sage 200 Spain

CVE-2023-2809

What is CVE-2023-2809?

A vulnerability exists in Sage 200 Spain 2023.38.001 that allows remote attackers to exploit plaintext credentials stored in the DLL application. By leveraging this weakness, an attacker could potentially extract SQL database credentials, facilitating unauthorized access and the execution of MS SQL commands, which may lead to privilege escalation on Windows systems.

References