Vulners
Lucene search
NLB mKlik Makedonija 3.3.12 SQL Injection
| Reporter | Title | Published | Views | Family All 8 |
|---|---|---|---|---|
 | CVE-2023-54163 | 31 Dec 202521:03 | – | circl |
 | NLB mKlik Macedonia SQL注入漏洞 | 30 Dec 202500:00 | – | cnnvd |
 | CVE-2023-54163 | 30 Dec 202522:41 | – | cve |
 | CVE-2023-54163 NLB mKlik Macedonia 3.3.12 SQL Injection via International Transfer Parameters | 30 Dec 202522:41 | – | cvelist |
 | EUVD-2023-60533 | 31 Dec 202500:31 | – | euvd |
 | CVE-2023-54163 | 30 Dec 202523:15 | – | nvd |
 | PT-2025-54253 | 30 Dec 202500:00 | – | ptsecurity |
 | CVE-2023-54163 NLB mKlik Macedonia 3.3.12 SQL Injection via International Transfer Parameters | 30 Dec 202522:41 | – | vulnrichment |
<html><body><p>NLB mKlik Makedonija 3.3.12 SQL Injection
Vendor: NLB Banka AD Skopje
Product web page: https://www.nlb.mk
Google Play: https://play.google.com/store/apps/details?id=hr.asseco.android.jimba.tutunskamk.production
Affected version: 3.3.12
Summary: NLB mKlik е мобилна апликација наменета за физички лица,
корисници на услугите на НЛБ Банка, која овозможува преглед на
различните продукти кои корисниците ги имаат во Банката како и
извршување на различни видови на трансакции на едноставен и пред
се безбеден начин во било кој период од денот. NLB mKlik апликацијата
може да се користи со Android верзија 5.0 или понова.
Desc: The mobile application or the affected API suffers from an SQL
Injection vulnerability. Input passed to the parameters that are
associated to international transfer is not properly sanitised before
being returned to the user or used in SQL queries. This can be exploited
to manipulate SQL queries by injecting arbitrary SQL code and disclose
sensitive information.
Tested on: Android 13
Vulnerability discovered by Neurogenesia
@zeroscience
Advisory ID: ZSL-2023-5797
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5797.php
23.12.2022
--
Incident ID: ZSL-122022-NLBTHR
------------------------------
DB data disclosure PoC (international transfer details/description trigger):
++
[select alfa1+' девизен прилив' opis from pts (nolock) where unikum =dbo.dodajnuli(:unikum ,14) and kod = 15111]
-
</p></body></html>Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
14 Oct 2023 00:00Current
6Medium risk
Vulners AI Score6
CVSS 3.17.5
CVSS 48.8
EPSS0.00025
SSVC