CVE-2023-34362

🗓️ 02 Jun 2023 00:00:00Reported by mitreType

cve

cve🔗 web.nvd.nist.gov📰️ 21 Media mentions👁 1493 Views🌐 WEB

CVE-2023-34362 SQL injection in MOVEit Transfe

Reporter	Title	Published	Views	Family All 83
GithubExploit	Exploit for SQL Injection in Progress Moveit_Cloud	9 Jul 202318:44	–	githubexploit
GithubExploit	Exploit for SQL Injection in Progress Moveit_Cloud	9 Jun 202319:07	–	githubexploit
GithubExploit	Exploit for SQL Injection in Progress Moveit_Cloud	6 Jun 202618:25	–	githubexploit
GithubExploit	Exploit for SQL Injection in Progress Moveit_Cloud	28 Jun 202417:13	–	githubexploit
GithubExploit	Exploit for SQL Injection in Progress Moveit_Cloud	31 Aug 202313:25	–	githubexploit
GithubExploit	Exploit for SQL Injection in Progress Moveit_Cloud	6 May 202600:17	–	githubexploit
GithubExploit	Exploit for Improper Input Validation in Lexmark Cxtpc_Firmware	7 Aug 202320:55	–	githubexploit
GithubExploit	Exploit for SQL Injection in Progress Moveit_Cloud	28 Jul 202505:55	–	githubexploit
GithubExploit	Exploit for SQL Injection in Progress Moveit_Cloud	21 Jan 202605:03	–	githubexploit
GithubExploit	Exploit for SQL Injection in Progress Moveit_Cloud	16 Jun 202300:39	–	githubexploit

NVD

Vulnrichment

Node

progress moveit_cloudRange<14.0.5.45

OR

progress moveit_cloudRange14.1.0.0–14.1.6.97

OR

progress moveit_cloudRange15.0.0.0–15.0.2.39

OR

progress moveit_transferRange<2021.0.7

OR

progress moveit_transferRange2021.1.0–2021.1.5

OR

progress moveit_transferRange2022.0.0–2022.0.5

OR

progress moveit_transferRange2022.1.0–2022.1.6

OR

progress moveit_transferRange2023.0.0–2023.0.2

Source	Link
packetstormsecurity	www.packetstormsecurity.com/files/173110/MOVEit-SQL-Injection.html
community	www.community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023
packetstormsecurity	www.packetstormsecurity.com/files/172883/MOVEit-Transfer-SQL-Injection-Remote-Code-Execution.html
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
grant_type	request body	api/v1/token	SQLi-exploitation flow leverages MOVEit token/API to obtain access and proceed with payload	CWE-89
username	request body	api/v1/token	SQLi-exploitation flow leverages MOVEit token/API to obtain access and proceed with payload	CWE-89
password	request body	api/v1/token	SQLi-exploitation flow leverages MOVEit token/API to obtain access and proceed with payload	CWE-89
name	request body	api/v1/folders/{id}/files	Resumable file upload endpoint used in exploit to plant deserialization gadget and trigger payload	CWE-89
size	request body	api/v1/folders/{id}/files	Resumable file upload endpoint used in exploit to plant deserialization gadget and trigger payload	CWE-89
comments	request body	api/v1/folders/{id}/files	Resumable file upload endpoint used in exploit to plant deserialization gadget and trigger payload	CWE-89
Transaction	request body	guestaccess.aspx	CSRF/injection entry point used to perform SQLi and payload delivery via guest session	CWE-89
Arg06	request body	guestaccess.aspx	CSRF/injection entry point used to perform SQLi and payload delivery via guest session	CWE-89
Arg12	request body	guestaccess.aspx	CSRF/injection entry point used to perform SQLi and payload delivery via guest session	CWE-89
csrftoken	request body	guestaccess.aspx	CSRF/injection entry point used to perform SQLi and payload delivery via guest session	CWE-89

17 Jun 2026 06:03Current

9.7High risk

Vulners AI Score9.7

CVSS 3.19.8

EPSS0.99934

SSVC

cve-2023-34362 sql injection moveit transfer vulnerability database security web application security nvd cve