CVE-2023-49363

The SQL Injection vulnerability (CWE-89) results from insufficient validation and sanitization of input data passed to the indexAction method in the reimpAction.php file. An attacker can inject malicious SQL code directly into queries executed by the application. The attack vector is network-based, requires no authentication or user interaction, making exploitation particularly simple.

An attacker can gain unauthorized access to data stored in the database, modify or delete data, and depending on the database server configuration, potentially take control of the system (full CIA triad: confidentiality, integrity, availability threatened at HIGH level).

Rockoa should be updated to version 2.3.3 or newer. If immediate update is not possible, it is recommended to restrict network access to the application and monitor traffic for SQL injection attempts.

Rockoa in versions below 2.3.3