Vulnerability · Published Dec 21, 2023 · Assigned by TR-CERT

CVE-2023-6145SQLi in Softomi E-commerce Software

Critical 9.8

In plain English

A critical-severity SQL injection in Softomi Advanced C2C Marketplace Software from İstanbul Soft Informatics and Consultancy Limited Company. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.5%top 55.7% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in İstanbul Soft Informatics and Consultancy Limited Company Softomi Advanced C2C Marketplace Software allows SQL Injection. This issue affects Softomi Advanced C2C Marketplace Software: before 12122023.

Affected products (as reported)

Vendor	Product	Versions
İstanbul Soft Informatics and Consultancy Limited Company	Softomi Advanced C2C Marketplace Software	0 – before 12122023

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://www.usom.gov.tr/bildirim/tr-23-0724 government-resource, broken-link
https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-23-0724 government-resource