CVE-2023-34751
Published: 14 June 2023
Summary
CVE-2023-34751 is a critical-severity SQL Injection (CWE-89) vulnerability in Bloofox Bloofoxcms. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 3.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
bloofox version 0.5.2.1 contains a SQL injection vulnerability tracked as CVE-2023-34751. The flaw is present in the administrative interface at admin/index.php?mode=user&page=groups&action=edit, where the gid parameter is not properly sanitized before being used in database queries. It is classified under CWE-89 and carries a CVSS 3.1 base score of 9.8, reflecting network-accessible attack vectors that require no authentication or user interaction.
An unauthenticated remote attacker can supply crafted input through the gid parameter to execute arbitrary SQL commands. Successful exploitation grants full read, write, and delete access to the underlying database, enabling complete compromise of the application and any stored credentials or content.
The supplied references point to a researcher disclosure that catalogs multiple similar injection issues in the same version but contain no official vendor advisory, patch details, or mitigation guidance. The associated EPSS score has remained steady at 0.3324 with no material increase since publication.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-38793
Vulnerability details
bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the gid parameter at admin/index.php?mode=user&page=groups&action=edit.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.