CVE-2023-26443: SQL Injection
Full-text autocomplete search allows user-provided SQL syntax to be injected to SQL statements. With existing sanitization in place, this can be abused to trigger benign SQL Exceptions but could potentially be escalated to a malicious SQL injection vulnerability. We now properly encode single quotes for SQL FULLTEXT queries. No publicly available exploits are known.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-26443?
CVE-2023-26443 is a vulnerability in the full-text autocomplete search feature of Open-xchange Appsuite Backend that allows injection of user-provided SQL syntax, which can potentially lead to a malicious SQL injection attack.
What is the severity of CVE-2023-26443?
CVE-2023-26443 has a severity rating of critical with a CVSS score of 9.8.
How does CVE-2023-26443 affect Open-xchange Appsuite Backend?
CVE-2023-26443 affects Open-xchange Appsuite Backend versions up to and including 7.10.6, as well as versions between 8.10.0 and 8.12.
How can CVE-2023-26443 be exploited?
CVE-2023-26443 can be exploited by injecting user-provided SQL syntax into SQL statements used by the full-text autocomplete search feature.
How to fix CVE-2023-26443?
To fix CVE-2023-26443, it is recommended to update to a patched version of Open-xchange Appsuite Backend and ensure that proper sanitization of user input is implemented.