B1i module of SAP Business One - version 10.0, application allows an authenticated user with deep knowledge to send crafted queries over the network to read or modify the SQL data. On successful exploitation, the attacker can cause high impact on confidentiality, integrity and availability of the application.
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:HSap Business One
APPSap10.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
SQLi
CWE
Related vulnerabilities
CVE-2023-31403CRITICAL9.6PL ✓same product
SAP Business One: brak uwierzytelnienia do folderu SMB podczas instalacji
CVE-2021-38180CRITICAL9.8PL ✓same product
SAP Business One – CSV Injection przy eksporcie danych do Excel
CVE-2016-6256CRITICAL9.6PL ✓same product
XXE w SAP Business One dla Android 1.2.3 — atak przez spreparowane dane XML
CVE-2023-39437HIGH7.6same product
SAP business One allows - version 10.0, allows an attacker to insert malicious code into the content of a web ...
CVE-2022-35292HIGH7.8same product
In SAP Business One application when a service is created, the executable path contains spaces and isn’t enclo...