CVE-2023-33509

KramerAV VIA GO² < 4.0.1.1326 is vulnerable to SQL Injection

Critical · published May 31, 2023

CVSS v3.1
9.8
EPSS
1%
Percentile
54.8
In the wild
Unconfirmed
What it is

🔥 A sneaky SQL injection lurks under the surface of KramerAV VIA GO² versions below 4.0.1.1326! Imagine a restaurant where anyone can slip a secret ingredient into any dish; that’s what this SQL injection does to your data — it allows attackers to serve themselves a full menu of sensitive information without ever being checked. With the right malicious SQL code, an attacker can access, modify, or even delete critical database records. This could lead to devastating data breaches, stolen information, and a major loss of trust. The potential fallout here could be absolutely catastrophic for both users and the organization!

Put simply

Imagine a restaurant where anyone can slip a secret ingredient into any dish; that’s what this SQL injection does to your data — it allows attackers to serve themselves a full menu of sensitive information without ever being checked. This vulnerability allows attackers to manipulate SQL queries in the KramerAV VIA GO² application, potentially granting them unauthorized access to the database and its contents.

What to do

With the right malicious SQL code, an attacker can access, modify, or even delete critical database records. This could lead to devastating data breaches, stolen information, and a major loss of trust. The potential fallout here could be absolutely catastrophic for both users and the organization! Update your KramerAV VIA GO² to version 4.0.1.1326 or later immediately to mitigate this vulnerability. Additionally, ensure that SQL statements are sanitized and use prepared statements to fend off such attacks in the future. You've got this! Take action now and you’ll have your defenses reinforced in no time! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00761 · 54.8th percentile
Published
2023-05-31T00:00Z
EPSS history
Timeline
  • 31 MAY 00:00Z
    KramerAV VIA GO² < 4.0.1.1326 is vulnerable to SQL Injection
    cvelistv5