Bylancer QuickOrder GET Parameter blog sql injection

CVE-2023-3690

What is CVE-2023-3690?

A vulnerability exists within the Bylancer QuickOrder version 6.3.7, specifically in the GET Parameter Handler component. An attacker can exploit this vulnerability by manipulating the 's' argument within the file /blog, leading to unauthorized SQL command execution. This flaw can be exploited remotely, allowing potential attackers to gain access to sensitive database information and perform malicious transactions. As of now, there has been no response from the vendor regarding this disclosure, highlighting the need for immediate attention and mitigation from users.

References