CVE-2023-3208

🗓️ 12 Jun 2023 15:00:07Reported by VulDBType

cve🔗 web.nvd.nist.gov👁 35 Views🌐 WEB

Vulnerability in RoadFlow Visual Process Engine .NET Core Mvc 2.13.3 enables remote SQL injection via /Log/Query endpoin

Reporter	Title	Published	Views	Family All 9
CNNVD	RoadFlow SQL注入漏洞	12 Jun 202300:00	–	cnnvd
Cvelist	CVE-2023-3208 RoadFlow Visual Process Engine .NET Core Mvc Login sql injection	12 Jun 202315:00	–	cvelist
EUVD	EUVD-2023-43886	3 Oct 202520:07	–	euvd
NVD	CVE-2023-3208	12 Jun 202315:15	–	nvd
OSV	CVE-2023-3208	12 Jun 202315:15	–	osv
Prion	Sql injection	12 Jun 202315:15	–	prion
Positive Technologies	PT-2023-23591 · Unknown · Roadflow Visual Process Engine	12 Jun 202300:00	–	ptsecurity
RedhatCVE	CVE-2023-3208	23 May 202501:57	–	redhatcve
Vulnrichment	CVE-2023-3208 RoadFlow Visual Process Engine .NET Core Mvc Login sql injection	12 Jun 202315:00	–	vulnrichment

NVD

Vulners

Node

roadflow roadflowMatch2.13.3

[
  {
    "vendor": "RoadFlow",
    "product": "Visual Process Engine .NET Core Mvc",
    "versions": [
      {
        "version": "2.13.3",
        "status": "affected"
      }
    ],
    "modules": [
      "Login"
    ]
  }
]

Source	Link
vuldb	www.vuldb.com/
github	www.github.com/yangxixx/vulhub/blob/master/activemq/RoadFlow.md
vuldb	www.vuldb.com/

Parameter	Position	Path	Description	CWE
sidx	query param	Log/Query?appid=0B736354-9473-4D66-B9C0-15CAC149EB05&tabid=tab_0B73635494734D66B9C015CAC149EB05	SQL injection via sidx/sord parameters in Log/Query endpoint (RoadFlow Visual Process Engine).	CWE-89
sord	query param	Log/Query?appid=0B736354-9473-4D66-B9C0-15CAC149EB05&tabid=tab_0B73635494734D66B9C015CAC149EB05	SQL injection via sidx/sord parameters in Log/Query endpoint (RoadFlow Visual Process Engine).	CWE-89

21 Nov 2024 08:16Current

7.7High risk

Vulners AI Score7.7

CVSS 3.16.3 - 8.8

CVSS 26.5

CVSS 36.3

EPSS0.00067

SSVC

CWE-89