CVE-2023-25223: SQL Injection
Published Mar 7, 2023
·Updated
CRMEB <=1.3.4 is vulnerable to SQL Injection via /api/admin/user/list.
Affected Software
1 affected component
crmeb CRMEB Java<=1.3.4
Event History
Mar 7, 2023
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2023-25223?
The severity of CVE-2023-25223 is high with a CVSS score of 7.2.
2
How does CVE-2023-25223 impact CRMEB <=1.3.4?
CVE-2023-25223 allows an attacker to perform SQL Injection via the /api/admin/user/list endpoint in CRMEB <=1.3.4.
3
How can I fix CVE-2023-25223?
To fix CVE-2023-25223, you should update CRMEB to a version above 1.3.4 if available or apply any patches or workarounds provided by the vendor.
4
Are there any references or resources available for CVE-2023-25223?
Yes, you can refer to the following link for more information: [github.com/crmeb/crmeb_java/issues/9](https://github.com/crmeb/crmeb_java/issues/9).
5
What is CWE-89?
CWE-89 is a category of vulnerability known as SQL Injection, which allows an attacker to manipulate SQL queries in a database.