A vulnerability, which was classified as critical, has been found in RoadFlow Visual Process Engine .NET Core Mvc 2.13.3. Affected by this issue is some unknown functionality of the file /Log/Query?appid=0B736354-9473-4D66-B9C0-15CAC149EB05&tabid=tab_0B73635494734D66B9C015CAC149EB05 of the component Login. The manipulation of the argument sidx/sord leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-231230 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
References
| Link | Resource |
|---|---|
| https://github.com/yangxixx/vulhub/blob/master/activemq/RoadFlow.md | Exploit Third Party Advisory |
| https://vuldb.com/?ctiid.231230 | Third Party Advisory |
| https://vuldb.com/?id.231230 | Third Party Advisory |
Configurations
History
27 Jun 2023, 13:09
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Roadflow
Roadflow roadflow |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
| CPE | cpe:2.3:a:roadflow:roadflow:2.13.3:*:*:*:*:*:*:* | |
| References | (MISC) https://vuldb.com/?id.231230 - Third Party Advisory | |
| References | (MISC) https://vuldb.com/?ctiid.231230 - Third Party Advisory | |
| References | (MISC) https://github.com/yangxixx/vulhub/blob/master/activemq/RoadFlow.md - Exploit, Third Party Advisory |
12 Jun 2023, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-06-12 15:15
Updated : 2024-05-17 02:27
NVD link : CVE-2023-3208
Mitre link : CVE-2023-3208
CVE.ORG link : CVE-2023-3208
JSON object : View
Products Affected
roadflow
- roadflow
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')