SQL Injection Vulnerability in Archibus App for iOS
CVE-2023-48645

7.8HIGH

Key Information:

Vendor

Eptura

Status
Archibus
Vendor
CVE Published:
2 February 2024

What is CVE-2023-48645?

An SQL injection vulnerability exists in the search work request feature within the Maintenance module of the Archibus app version 4.0.3 for iOS. This issue occurs due to improper handling of user inputs when the app synchronizes its local database with a central web server instance. Exploiting this vulnerability allows a malicious user to manipulate SQL queries sent to the local database, potentially exposing sensitive information and undermining the integrity of the application. Users and organizations utilizing this application should implement necessary security measures to mitigate potential risks associated with this vulnerability.

References

https://excellium-services.com/cert-xlm-advisory/CVE-2023...
https://cds.thalesgroup.com/en/tcs-cert/CVE-2023-48645

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.