SQL Injection Vulnerability in YonBIP by Yonyou
CVE-2023-51927

9.8CRITICAL

Key Information:

Vendor

Yonyou

Status
Yonbip
Vendor
CVE Published:
20 January 2024

What is CVE-2023-51927?

YonBIP v3_23.05 contains a SQL injection vulnerability that could allow unauthorized users to execute arbitrary SQL commands through improperly sanitized input. This vulnerability is present in the com.yonyou.hrcloud.attend.web.AttendScriptController.runScript() method, which may enable attackers to manipulate the database and gain access to sensitive information.

References

https://www.yonyou.com/
http://yonbip.com
https://github.com/cxcxcxcxcxcxcxc/cxcxcxcxcxcxcxc/blob/m...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.