CVE-2023-34362

🗓️ 02 Jun 2023 00:00:00Reported by mitreType

cve

cve🔗 web.nvd.nist.gov📰️ 21 Media mentions👁 1412 Views🌐 WEB

CVE-2023-34362 SQL injection in MOVEit Transfe

Reporter	Title	Published	Views	Family All 83
GithubExploit	Exploit for SQL Injection in Progress Moveit_Cloud	9 Jul 202318:44	–	githubexploit
GithubExploit	Exploit for SQL Injection in Progress Moveit_Cloud	9 Jun 202319:07	–	githubexploit
GithubExploit	Exploit for SQL Injection in Progress Moveit_Cloud	6 Jun 202618:25	–	githubexploit
GithubExploit	Exploit for SQL Injection in Progress Moveit_Cloud	28 Jun 202417:13	–	githubexploit
GithubExploit	Exploit for SQL Injection in Progress Moveit_Cloud	31 Aug 202313:25	–	githubexploit
GithubExploit	Exploit for SQL Injection in Progress Moveit_Cloud	6 May 202600:17	–	githubexploit
GithubExploit	Exploit for Improper Input Validation in Lexmark Cxtpc_Firmware	7 Aug 202320:55	–	githubexploit
GithubExploit	Exploit for SQL Injection in Progress Moveit_Cloud	28 Jul 202505:55	–	githubexploit
GithubExploit	Exploit for SQL Injection in Progress Moveit_Cloud	21 Jan 202605:03	–	githubexploit
GithubExploit	Exploit for SQL Injection in Progress Moveit_Cloud	16 Jun 202300:39	–	githubexploit

NVD

Vulnrichment

Node

progress moveit_cloudRange<14.0.5.45

OR

progress moveit_cloudRange14.1.0.0–14.1.6.97

OR

progress moveit_cloudRange15.0.0.0–15.0.2.39

OR

progress moveit_transferRange<2021.0.7

OR

progress moveit_transferRange2021.1.0–2021.1.5

OR

progress moveit_transferRange2022.0.0–2022.0.5

OR

progress moveit_transferRange2022.1.0–2022.1.6

OR

progress moveit_transferRange2023.0.0–2023.0.2

Source	Link
packetstormsecurity	www.packetstormsecurity.com/files/173110/MOVEit-SQL-Injection.html
community	www.community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023
packetstormsecurity	www.packetstormsecurity.com/files/172883/MOVEit-Transfer-SQL-Injection-Remote-Code-Execution.html
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
folders_id	path	/api/v1/folders/{folders_id}/files	MOVEit Transfer API resumable file upload endpoint used in SQL injection PoC	CWE-89
uploadType	path	/api/v1/folders/{folders_id}/files	MOVEit Transfer API resumable file upload endpoint used in SQL injection PoC	CWE-89
fileId	path	/api/v1/folders/{folders_id}/files	MOVEit Transfer API resumable file upload endpoint used in SQL injection PoC	CWE-89
csrftoken	path	/guestaccess.aspx	Guest access flow used to perform CSRF-enabled SQL injection in MOVEit Transfer PoC	CWE-89
Arg06	path	/guestaccess.aspx	Guest access flow used to perform CSRF-enabled SQL injection in MOVEit Transfer PoC	CWE-89
Arg12	path	/guestaccess.aspx	Guest access flow used to perform CSRF-enabled SQL injection in MOVEit Transfer PoC	CWE-89
action	path	/moveitisapi/moveitisapi.dll?action=capa	ISAPI endpoint that can be used in MOVEit Transfer for capabilities; leveraged in PoC for injection	CWE-89
X-siLock-Transaction	path	/moveitisapi/moveitisapi.dll?action=capa	ISAPI endpoint that can be used in MOVEit Transfer for capabilities; leveraged in PoC for injection	CWE-89
grant_type	path	/api/v1/token	API token endpoint used in PoC to obtain access token for subsequent actions	CWE-89
username	path	/api/v1/token	API token endpoint used in PoC to obtain access token for subsequent actions	CWE-89

27 Oct 2025 14:37Current

9.7High risk

Vulners AI Score9.7

CVSS 3.19.8

EPSS0.94254

SSVC

cve-2023-34362 sql injection moveit transfer vulnerability database security web application security nvd cve