CVE-2023-5155CWE-89

SQLi in Utarit's Smart Deposit System

Critical · published February 15, 2024

CVSS v3.1
9.8
EPSS
1%
Percentile
43.3
In the wild
Unconfirmed
What it is

🚨 A sneaky SQL injection lurks in the SoliPay Mobile App, ready to breach your database if you’re still running version 5.0.7 or earlier! 🔥 Think of it as a restaurant where the chef blindly accepts any order without checking — an attacker could simply add whatever they want to the menu and serve it right to the customers! This vulnerability could allow an attacker to manipulate SQL commands, leading to unauthorized access to sensitive data, modifying or even deleting crucial information. It’s an open door for data breaches, which is absolutely devastating for both your users and your reputation!

Put simply

Think of it as a restaurant where the chef blindly accepts any order without checking — an attacker could simply add whatever they want to the menu and serve it right to the customers! The flaw arises from improper neutralization of special elements in SQL commands, enabling attackers to inject malicious SQL queries via the SoliPay Mobile App.

What to do

This vulnerability could allow an attacker to manipulate SQL commands, leading to unauthorized access to sensitive data, modifying or even deleting crucial information. It’s an open door for data breaches, which is absolutely devastating for both your users and your reputation! Update the SoliPay Mobile App immediately to version 5.0.8 or a later release. Additionally, ensure that all SQL queries are properly sanitized to prevent injection attacks in the future. It's crucial to re-evaluate your application's security posture regularly! You've got this! Patch that app and secure your users’ data like the hero you are! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00519 · 43.3th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2024-02-15T15:46Z
EPSS history
Timeline
  • 15 FEB 15:46Z
    SQLi in Utarit's Smart Deposit System
    cvelistv5