CVE-2023-3793: Weaver e-cology HTTP POST Request filelFileDownloadForOutDoc.class sql injection
A vulnerability was found in Weaver e-cology. It has been rated as critical. This issue affects some unknown processing of the file filelFileDownloadForOutDoc.class of the component HTTP POST Request Handler. The manipulation of the argument fileid with the input 1+WAITFOR+DELAY leads to sql injection. Upgrading to version 10.58.0 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-235061 was assigned to this vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Weaver e-cologyto a version that resolves this vulnerability.Fixed in 10.58.0Patch VDB-235061 - Compensating control
Add compensating controls to prevent exploitation of SQL injection via the HTTP POST Request Handler filelFileDownloadForOutDoc.class argument fileid (e.g., restrict/validate HTTP POST endpoints and block malicious patterns like `1+WAITFOR+DELAY` at a WAF/firewall) until the upgrade to 10.58.0 is completed.
Event History
Frequently Asked Questions
What is the severity of CVE-2023-3793?
CVE-2023-3793 has been rated as critical due to its potential impact and exploitability.
How do I fix CVE-2023-3793?
To fix CVE-2023-3793, update Weaver e-cology to a version later than 10.58.0.
What components are affected by CVE-2023-3793?
CVE-2023-3793 affects the file filelFileDownloadForOutDoc.class within the HTTP POST Request Handler component.
What type of attack does CVE-2023-3793 enable?
CVE-2023-3793 enables an attack that leads to a delay in file download processing, potentially impacting service availability.
Is there a known exploit for CVE-2023-3793?
Yes, there are known exploits that manipulate the argument fileid to perform attacks on the affected system.