CVE-2023-28701

Published Jun 2, 2023

Last updated a year ago

CVSS critical 9.8

Overview

Description: ELITE TECHNOLOGY CORP. Web Fax has a vulnerability of SQL Injection. An unauthenticated remote attacker can inject SQL commands into the input field of the login page to perform arbitrary system commands, disrupt service or terminate service.
Source: twcert@cert.org.tw
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

twcert@cert.org.tw: CWE-89

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:elite:webfax:-:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "24384CFC-5FBC-4931-9867-41B249A0AD40"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References