Enterprise & Mobile
SQL / NoSQL Injection
IDURAR ERP/CRM NoSQL injection
IDURAR ERP/CRM NoSQL injection SQL injection vulnerability via the component /api/login.
9.8
/ 10
Critical
CVSS v3.1
ADVISORY ID
PS70
PUBLISHED
2023-06-19
CVE IDs
CVE-2023-27742
VENDORS
IDURAR
PUBLIC EXPLOIT
PoC public
CWE
CWE-89
PRODUCT
IDURAR ERP/CRM v1
CVSS VECTOR
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
.png)
Summary
Overview
IDURAR ERP/CRM NoSQL injection
SQL injection vulnerability via the component /api/login.
Vulnerability details
Vulnerability details
CVE-2023-27742
CWE-89
Critical | 9.8
IDURAR ERP/CRM NoSQL injection SQL injection vulnerability via the component /api/login.
Auth:
None (remote)
Impact:
Sensitive data disclosure, arbitrary data or code modification, denial of service
DISCLOSURE
Disclosure timeline
2023-02-28 Reported On
2023-03-30 Made Public On
Fixed On: Not Fixed
References
2026-06-17 (NVD record)
Credits
Soummya Mukhopadhyay
Related Advisories
jscript.dll - ActiveXObject BSTR - Use After Free
Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.
Browser
Memory Corruption
CWE-787
2022-09-27
High
Adobe Reader Out-Of-Bounds Read Information Disclosure Vulnerability
Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Adobe…
Desktop Software
Memory Corruption
CWE-125
2022-10-01
Medium
Opera Mini Location Permission Spoof
Opera Mini Location Permission Spoof Vulnerability A location permission spoof vulnerability was discovered in opera mini 47.1.2249.129326 for Android which allows an attacker to spoof location…
Browser
Spoofing
2022-10-01
Medium
Concerned about a similar issue in your product?
Payatu's researchers find these vulnerabilities before attackers do. Talk to us about product, firmware and IoT security testing.
