CVE-2023-1545 SQL Injection in nilsteampassnet/teampass
An attacker can exploit SQL injection in TeamPass to read or modify sensitive password data stored in the database.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-1545?
CVE-2023-1545 is a high-severity SQL injection vulnerability in Teampass Teampass, published on 21 Mar 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SQL Injection in GitHub repository nilsteampassnet/teampass prior to 3.0.0.23.
Weakness: CWE-89
Which versions are affected by CVE-2023-1545?
2 open source packages ship an affected version, including nilsteampassnet/teampass. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
nilsteampassnet/teampass Packagist | All versions | 3.0.0.22 |
nilsteampassnet/teampass Packagist | All versions | 3.0.0.22 |
Products include Teampass Teampass.
How do I fix CVE-2023-1545?
Upgrade nilsteampassnet/teampass to 3.0.0.22 or later.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2023-1545 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-1545 exists.
Public exploit code: 1 Exploit-DB entry and 4 proofs of concept on GitHub.
Other vulnerabilities in Teampass Teampass
Sources
Also known as GHSA-ppxm-q2h4-v7mm.