CVE-2023-34754

Deeper analysis

bloofox version 0.5.2.1 contains a SQL injection vulnerability in the pid parameter of the URL path admin/index.php?mode=settings&page=plugins&action=edit. The flaw is tracked as CWE-89 and carries a CVSS 3.1 base score of 9.8, reflecting network attack vector, low attack complexity, and no required credentials or user interaction.

An unauthenticated remote attacker can supply crafted input to the affected parameter and execute arbitrary SQL statements against the underlying database. Successful exploitation can result in full read, write, or delete access to application data and, depending on database privileges, may allow operating-system command execution or privilege escalation.

Public references consist of a technical disclosure that catalogs multiple similar injection issues in the same release; no vendor advisory, patch information, or mitigation guidance is provided in the available sources. The associated EPSS score has reached a peak of 0.1492 with a current value of 0.1280, indicating moderate and slightly elevated exploitation interest since disclosure.