Vulnerability Description
An issue was discovered in /fcgi/scrut_fcgi.fcgi in Plixer Scrutinizer before 19.3.1. The csvExportReport endpoint action generateCSV is vulnerable to SQL injection through the sorting parameter, allowing an unauthenticated user to execute arbitrary SQL statements in the context of the application's backend database server.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Plixer | Scrutinizer | < 19.3.1 |
Related Weaknesses (CWE)
References
- https://github.com/atredispartners/advisories/blob/master/ATREDIS-2023-0001.mdExploitThird Party Advisory
- https://github.com/atredispartners/advisories/blob/master/ATREDIS-2023-0001.mdExploitThird Party Advisory
FAQ
What is CVE-2023-41262?
CVE-2023-41262 is a vulnerability with a CVSS score of 9.8 (CRITICAL). An issue was discovered in /fcgi/scrut_fcgi.fcgi in Plixer Scrutinizer before 19.3.1. The csvExportReport endpoint action generateCSV is vulnerable to SQL injection through the sorting parameter, allo...
How severe is CVE-2023-41262?
CVE-2023-41262 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2023-41262?
Check the references section above for vendor advisories and patch information. Affected products include: Plixer Scrutinizer.