Election Services Co. (ESC) Internet Election Service is vulnerable to SQL injection in multiple pages and parameters. These vulnerabilities allow an unauthenticated, remote attacker to read or modify data for any elections that share the same backend database. ESC deactivated older and unused elections and enabled web application firewall (WAF) protection for current and future elections on or around 2023-08-12.
References
Configurations
History
07 Nov 2023, 04:22
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://schemasecurity.co/private-elections.pdf - | |
| References | () https://www.electionservicesco.com/pages/services_internet.php - | |
| References | () https://www.youtube.com/watch?v=yeG1xZkHc64 - |
16 Oct 2023, 13:15
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:electionservicesco:internet_election_service:-:*:*:*:*:*:*:* | |
| CWE | CWE-89 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| First Time |
Electionservicesco
Electionservicesco internet Election Service |
|
| References | (MISC) https://schemasecurity.co/private-elections.pdf - Exploit, Third Party Advisory | |
| References | (MISC) https://www.youtube.com/watch?v=yeG1xZkHc64 - Exploit, Third Party Advisory | |
| References | (MISC) https://www.electionservicesco.com/pages/services_internet.php - Broken Link |
10 Oct 2023, 18:20
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-10-10 18:15
Updated : 2024-08-02 08:15
NVD link : CVE-2023-4309
Mitre link : CVE-2023-4309
CVE.ORG link : CVE-2023-4309
JSON object : View
Products Affected
electionservicesco
- internet_election_service
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')