CVE-2023-34362

🗓️ 02 Jun 2023 00:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 22 Media mentions👁 1555 Views🌐 WEB

CVE-2023-34362 SQL injection in MOVEit Transfe

Reporter	Title	Published	Views	Family All 83
GithubExploit	Exploit for SQL Injection in Progress Moveit_Cloud	9 Jul 202318:44	–	githubexploit
GithubExploit	Exploit for SQL Injection in Progress Moveit_Cloud	9 Jun 202319:07	–	githubexploit
GithubExploit	Exploit for SQL Injection in Progress Moveit_Cloud	6 Jun 202618:25	–	githubexploit
GithubExploit	Exploit for SQL Injection in Progress Moveit_Cloud	28 Jun 202417:13	–	githubexploit
GithubExploit	Exploit for SQL Injection in Progress Moveit_Cloud	31 Aug 202313:25	–	githubexploit
GithubExploit	Exploit for SQL Injection in Progress Moveit_Cloud	6 May 202600:17	–	githubexploit
GithubExploit	Exploit for Improper Input Validation in Lexmark Cxtpc_Firmware	7 Aug 202320:55	–	githubexploit
GithubExploit	Exploit for SQL Injection in Progress Moveit_Cloud	28 Jul 202505:55	–	githubexploit
GithubExploit	Exploit for SQL Injection in Progress Moveit_Cloud	21 Jan 202605:03	–	githubexploit
GithubExploit	Exploit for SQL Injection in Progress Moveit_Cloud	16 Jun 202300:39	–	githubexploit

NVD

Vulnrichment

Node

progress moveit_cloudRange<14.0.5.45

progress moveit_cloudRange14.1.0.0–14.1.6.97

progress moveit_cloudRange15.0.0.0–15.0.2.39

progress moveit_transferRange<2021.0.7

progress moveit_transferRange2021.1.0–2021.1.5

progress moveit_transferRange2022.0.0–2022.0.5

progress moveit_transferRange2022.1.0–2022.1.6

progress moveit_transferRange2023.0.0–2023.0.2

Source	Link
packetstormsecurity	www.packetstormsecurity.com/files/173110/MOVEit-SQL-Injection.html
community	www.community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023
packetstormsecurity	www.packetstormsecurity.com/files/172883/MOVEit-Transfer-SQL-Injection-Remote-Code-Execution.html
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
grant_type	request body	api/v1/token	MOVEit Transfer API token endpoint vulnerable to SQL injection via login flow in exploit; parameterized inputs may be unsafely processed leading to SQLi.	CWE-89
username	request body	api/v1/token	MOVEit Transfer API token endpoint vulnerable to SQL injection via login flow in exploit; parameterized inputs may be unsafely processed leading to SQLi.	CWE-89
password	request body	api/v1/token	MOVEit Transfer API token endpoint vulnerable to SQL injection via login flow in exploit; parameterized inputs may be unsafely processed leading to SQLi.	CWE-89
Authorization	header	api/v1/folders	Directory listing via API may be used in conjunction with SQLi in folder/file upload flows to reach backend data; requires token in header.	CWE-89
id	path / query param	api/v1/folders/{id}/files?uploadType=resumable	Resumable file upload endpoint used in exploit to stage a payload; potential SQLi/vector through path param and query string.	CWE-89
uploadType	path / query param	api/v1/folders/{id}/files?uploadType=resumable	Resumable file upload endpoint used in exploit to stage a payload; potential SQLi/vector through path param and query string.	CWE-89
fileId	path	api/v1/files/{fileId}	Access to file resource; used in exploit to leak encryption key and trigger deserialization gadget; parameter is vulnerable to injection in some flows.	CWE-89
Transaction	body	guestaccess.aspx	Guest access flow used to achieve CSRF and SQLi payload delivery; vulnerable through POST body parameters.	CWE-89
Arg06	body	guestaccess.aspx	Guest access flow used to achieve CSRF and SQLi payload delivery; vulnerable through POST body parameters.	CWE-89
Arg12	body	guestaccess.aspx	Guest access flow used to achieve CSRF and SQLi payload delivery; vulnerable through POST body parameters.	CWE-89