CVE-2023-7039
Byzoro S210 importexport.php injection
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
A vulnerability classified as critical has been found in Byzoro S210 up to 20231210. Affected is an unknown function of the file /importexport.php. The manipulation of the argument sql leads to injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-248688.
Una vulnerabilidad ha sido encontrada en Beijing Baichuo S210 hasta 20231210 y clasificada como crítica. Una función desconocida del archivo /importexport.php es afectada por esta vulnerabilidad. La manipulación del argumento sql conduce a la inyección. Es posible lanzar el ataque de forma remota. La explotación ha sido divulgada al público y puede utilizarse. El identificador de esta vulnerabilidad es VDB-248688.
Es wurde eine kritische Schwachstelle in Byzoro S210 bis 20231210 entdeckt. Dabei betrifft es einen unbekannter Codeteil der Datei /importexport.php. Dank der Manipulation des Arguments sql mit unbekannten Daten kann eine injection-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei über das Netzwerk erfolgen. Der Exploit steht zur öffentlichen Verfügung.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2023-12-21 CVE Reserved
- 2023-12-21 CVE Published
- 2024-04-10 EPSS Updated
- 2024-08-02 CVE Updated
- 2024-08-02 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CAPEC
References (2)
URL | Tag | Source |
---|---|---|
https://vuldb.com/?submit.250043 | Third Party Advisory |
URL | Date | SRC |
---|---|---|
https://github.com/Stitch3612/cve/blob/main/rce.md | 2024-08-02 |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Byzoro Search vendor "Byzoro" | Smart S210 Firmware Search vendor "Byzoro" for product "Smart S210 Firmware" | <= 2023-12-10 Search vendor "Byzoro" for product "Smart S210 Firmware" and version " <= 2023-12-10" | - |
Affected
| in | Byzoro Search vendor "Byzoro" | Smart S210 Search vendor "Byzoro" for product "Smart S210" | - | - |
Safe
|