CVE-2023-45657
Published: 06 November 2023
Summary
CVE-2023-45657 is a high-severity SQL Injection (CWE-89) vulnerability in Posimyth Nexter. Its CVSS base score is 8.5 (High).
Operationally, ranked in the top 6.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2023-45657 is a SQL injection vulnerability (CWE-89) affecting the Nexter WordPress theme by POSIMYTH. The flaw stems from improper neutralization of special elements in SQL commands and impacts all versions through 2.0.3, allowing an authenticated attacker to manipulate database queries.
An attacker with low-privileged network access can exploit the issue without user interaction, achieving high confidentiality impact and limited availability impact while affecting components beyond the vulnerable scope. The CVSS 8.5 rating reflects the combination of low attack complexity and the ability to read or exfiltrate sensitive data from the underlying database.
Advisories published on Patchstack identify the affected Nexter theme versions and recommend applying the vendor-supplied update that resolves the injection vector. No additional configuration changes or workarounds are detailed in the references.
The EPSS score has remained in the 0.11–0.12 range with only a modest peak-to-current difference, indicating steady but not sharply increasing exploitation interest since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-49948
Vulnerability details
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in POSIMYTH Nexter allows SQL Injection.This issue affects Nexter: from n/a through 2.0.3.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.