Vulnerability · Published Dec 29, 2023 · Assigned by TR-CERT
CVE-2023-4674SQLi in Yazteks E-Commerce Software
Unrated
In plain English
A SQL injection in E-Commerce Software from Yaztek Software Technologies and Computer Systems. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).
Severity (CVSS )–Not rated
Exploit odds (30 days)0.3%top 80.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Yaztek Software Technologies and Computer Systems E-Commerce Software allows SQL Injection. This issue affects E-Commerce Software: through 20231229. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Yaztek Software Technologies and Computer Systems | E-Commerce Software | 0 – through 20231229 |
Weakness: CWE-89
References
- https://www.usom.gov.tr/bildirim/tr-23-0741 government-resource, broken-link
- https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-23-0741 government-resource