CVE-2023-45674: SQL injection vulnerability in Farmbot-Web-App
First published: Fri Oct 13 2023(Updated: )
Farmbot-Web-App is a web control interface for the Farmbot farm automation platform. An SQL injection vulnerability was found in FarmBot's web app that allows authenticated attackers to extract arbitrary data from its database (including the user table). This issue may lead to Information Disclosure. This issue has been patched in version 15.8.4. Users are advised to upgrade. There are no known workarounds for this issue.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Farmers Wife | <15.8.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2023-45674.
What is the title of the vulnerability?
The title of the vulnerability is 'Farmbot-Web-App SQL injection vulnerability'.
What is Farmbot-Web-App?
Farmbot-Web-App is a web control interface for the Farmbot farm automation platform.
What is the severity of CVE-2023-45674?
The severity of CVE-2023-45674 is high with a CVSS score of 6.5.
What is the affected software?
The affected software is Farmbot-Web-App version up to 15.8.4.
How does the SQL injection vulnerability in Farmbot-Web-App work?
The SQL injection vulnerability in Farmbot-Web-App allows authenticated attackers to extract arbitrary data from its database, including the user table.
What is the potential impact of the SQL injection vulnerability?
The SQL injection vulnerability in Farmbot-Web-App may lead to information disclosure.
How can I fix CVE-2023-45674?
To fix CVE-2023-45674, update Farmbot-Web-App to a version beyond 15.8.4.
Where can I find more information about CVE-2023-45674?
You can find more information about CVE-2023-45674 at the following reference: [GitHub Advisory](https://github.com/FarmBot/Farmbot-Web-App/security/advisories/GHSA-pgq5-ff74-g7xq).
What is the Common Weakness Enumeration (CWE) ID?
The CWE ID associated with CVE-2023-45674 is CWE-89 (SQL Injection).
- agent/author
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/severity
- agent/weakness
- agent/references
- agent/last-modified-date
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-api
- agent/softwarecombine
- vendor/farmbot
- canonical/farmers wife