Vulnerability · Published Aug 2, 2023 · Assigned by OX
CVE-2023-26443
Medium 5.5
In plain English
A medium-severity SQL injection in OX App Suite from OX Software GmbH. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities).
Official description
Full-text autocomplete search allows user-provided SQL syntax to be injected to SQL statements. With existing sanitization in place, this can be abused to trigger benign SQL Exceptions but could potentially be escalated to a malicious SQL injection vulnerability. We now properly encode single quotes for SQL FULLTEXT queries. No publicly available exploits are known.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| OX Software GmbH | OX App Suite | 0 – through 7.10.6-rev420 – through 8.11 |
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L
References
- https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6230_7.10.6_2023-05-02.pdf release-notes
- https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0003.json vendor-advisory
- http://seclists.org/fulldisclosure/2023/Aug/8
- http://packetstormsecurity.com/files/173943/OX-App-Suite-SSRF-SQL-Injection-Cross-Site-Scripting.html