CVE-2023-33364

CVE-2023-33364 affects Suprema BioStar 2 prior to v2.9.1. The vulnerability is an OS command injection exploitable by authenticated users on the BioStar 2 server. Impact is exposure of command execution with high severity (per CVSSv3.1 data: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No specific explo...

CVE-2023-33365

CVE-2023-33365 affects Suprema BioStar 2, with versions prior to 2.9.1 vulnerable to a path traversal in the server’s web UI that allows unauthenticated retrieval of arbitrary files. The vulnerability originates from improper access control in the web server component, enabling an attacker to fet...

PT-2023-24311 · Suprema · Biostar 2

Name of the Vulnerable Software and Affected Versions: Suprema BioStar 2 versions prior to 2.9.1 Description: An authentication bypass issue exists, allowing unauthenticated users to access some functionality on BioStar 2 servers. Recommendations: For Suprema BioStar 2 versions prior to 2.9.1,...

CVE-2023-31923

Suprema BioStar 2 before 2022 Q4, v2.9.1 has Insecure Permissions. A vulnerability in the web application allows an authenticated attacker with "User Operator" privileges to create a highly privileged user account. The vulnerability is caused by missing server-side validation, which can be...

CVE-2023-31923

Suprema BioStar 2 before 2022 Q4, v2.9.1 has Insecure Permissions. A vulnerability in the web application allows an authenticated attacker with "User Operator" privileges to create a highly privileged user account. The vulnerability is caused by missing server-side validation, which can be...

Input validation

Suprema BioStar 2 before 2022 Q4, v2.9.1 has Insecure Permissions. A vulnerability in the web application allows an authenticated attacker with "User Operator" privileges to create a highly privileged user account. The vulnerability is caused by missing server-side validation, which can be...

CVE-2023-31923

Suprema BioStar 2 before 2022 Q4, v2.9.1 has Insecure Permissions. A vulnerability in the web application allows an authenticated attacker with "User Operator" privileges to create a highly privileged user account. The vulnerability is caused by missing server-side validation, which can be...

Suprema BioStar 2 安全漏洞

Suprema BioStar 2 is a web-based biometric security smart lock platform from Suprema Korea. A security vulnerability exists in Suprema BioStar 2 versions prior to v2.9.1, which stems from a lack of server-side authentication. An attacker can exploit this vulnerability to gain system administrator...

PT-2023-23524 · Suprema · Suprema Biostar 2

Name of the Vulnerable Software and Affected Versions: Suprema BioStar 2 versions prior to 2.9.1 Description: A vulnerability in the web application of Suprema BioStar 2 allows an authenticated attacker with User Operator privileges to create a highly privileged user account. This issue is caused...

CVE-2023-31923

Suprema BioStar 2 before 2022 Q4, v2.9.1 has Insecure Permissions. A vulnerability in the web application allows an authenticated attacker with "User Operator" privileges to create a highly privileged user account. The vulnerability is caused by missing server-side validation, which can be...

CVE-2023-31923

Affected software: Suprema BioStar 2 (before 2022 Q4, v2.9.1). Vulnerability: Web application allows an authenticated user with "User Operator" privileges to create a highly privileged user account due to missing server-side validation. Impact: Potential full administrator privileges on the syste...

Suprema BioStar 2 v2.8.16 - SQL Injection Vulnerability

Exploit Title: Suprema BioStar 2 v2.8.16 - SQL Injection Exploit Author: Yuriy Vander Tsarenko https://www.linkedin.com/in/yuriy-tsarenko-a1453aa4/ Vendor Homepage: https://www.supremainc.com/ Software Link: https://www.supremainc.com/en/platform/hybrid-security-platform-biostar-2.asp Software...

Suprema BioStar 2 v2.8.16 - SQL Injection

Exploit Title: Suprema BioStar 2 v2.8.16 - SQL Injection Date: 26/03/2023 Exploit Author: Yuriy Vander Tsarenko https://www.linkedin.com/in/yuriy-tsarenko-a1453aa4/ Vendor Homepage: https://www.supremainc.com/ Software Link:...

CVE-2023-27167

Suprema BioStar 2 v2.8.16 was discovered to contain a SQL injection vulnerability via the values parameter at /users/absence?searchmonth=1...

Sql injection

Suprema BioStar 2 v2.8.16 was discovered to contain a SQL injection vulnerability via the values parameter at /users/absence?searchmonth=1...

CVE-2023-27167

Suprema BioStar 2 v2.8.16 was discovered to contain a SQL injection vulnerability via the values parameter at /users/absence?searchmonth=1...

CVE-2023-27167

Summary of CVE-2023-27167 (Suprema BioStar 2) : A SQL injection vulnerability exists in BioStar 2 v2.8.16 where the flaw occurs via the values parameter in the absence endpoint (examples mention /users/absence?search_month=1 or /api/users/absence?search_month=1). The root cause is improper neutra...

CVE-2023-27167

Suprema BioStar 2 v2.8.16 was discovered to contain a SQL injection vulnerability via the values parameter at /users/absence?searchmonth=1...

Suprema BioStar 2 2.8.16 SQL Injection

Exploit Title: CVE-2023-27167 - Suprema BioStar 2 v2.8.16 - SQL Injection Date: 26/03/2023 Exploit Author: Yuriy Vander Tsarenko https://www.linkedin.com/in/yuriy-tsarenko-a1453aa4/ Vendor Homepage: https://www.supremainc.com/ Software Link:...

Suprema BioStar 2安全漏洞

Suprema BioStar 2 is a web-based biometric security smart lock platform from Suprema Korea. A security vulnerability exists in Suprema BioStar 2 version v2.8.16, which can be exploited by an attacker to elevate privileges to the system administrator via a crafted PUT request on the configuration...