CVE-2023-48645: SQL Injection
An issue was discovered in the Archibus app 4.0.3 for iOS. It uses a local database that is synchronized with a Web central server instance every time the application is opened, or when the refresh button is used. There is a SQL injection in the search work request feature in the Maintenance module of the app. This allows performing queries on the local database.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-48645?
CVE-2023-48645 has been classified as a medium severity vulnerability due to the potential for SQL injection.
How do I fix CVE-2023-48645?
To fix CVE-2023-48645, users should update the Archibus app to the latest version that addresses the SQL injection flaw.
What impact does CVE-2023-48645 have on data security?
CVE-2023-48645 could allow an attacker to execute arbitrary SQL queries, potentially exposing sensitive data from the application’s database.
Is CVE-2023-48645 still exploitable in versions after 4.0.3?
CVE-2023-48645 is specifically tied to Archibus app version 4.0.3, so later versions should not be affected if they have patched the vulnerability.
Who is affected by CVE-2023-48645?
CVE-2023-48645 affects users of the Archibus app version 4.0.3 for iOS who utilize the search work request feature in the Maintenance module.