VulnerabilityModified

CVE-2023-35064

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Satos Satos Mobile allows SQL Injection through SOAP Parameter Tampering.

CRITICAL 9.8EPSS 0.74%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.74%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Satos Satos Mobile allows SQL Injection through SOAP Parameter Tampering. This issue affects Satos Mobile: before 20230607.

CVSS 3.1: 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.74% probability · 52th percentile
CISA KEV: Not listed
Weakness: CWE-89
Affected: satos/satos mobile
Source: iletisim@usom.gov.tr

References

https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-23-0346
https://www.usom.gov.tr/bildirim/tr-23-0346
https://https://www.usom.gov.tr/bildirim/tr-23-0346Broken Link

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.