CVE-2023-21521 SQL injection in AtHoc
An SQL injection flaw in the Management Console allows attackers to read or modify database data and potentially execute OS commands.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-21521?
CVE-2023-21521 is a high-severity SQL injection vulnerability in BlackBerry AtHoc, published on 12 Sep 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
An SQL Injection vulnerability in the Management Console (Operator Audit Trail) of BlackBerry AtHoc version 7.15 could allow an attacker to potentially read sensitive data from the database, modify database data (Insert/Update/Delete), execute administration operations on the database, recover the content of a given file present on the DBMS file system and in some cases issue commands to the operating system.
Weakness: CWE-89
Which versions are affected by CVE-2023-21521?
It affects 1 product.
Products include Blackberry Athoc.
How do I fix CVE-2023-21521?
No fix has been published for CVE-2023-21521 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2023-21521 being exploited?
There is no known exploitation of CVE-2023-21521 in the wild and no public exploit code.
Other vulnerabilities in BlackBerry AtHoc
- CVE-2023-21522 Cross-site scripting in AtHoc
- CVE-2019-8997 An XML External Entity Injection (XXE) vulnerability in the Management System (console) of BlackBerry AtHoc versions earlier than 7.6 HF-567
- CVE-2023-21523 Cross-site scripting in AtHoc
- CVE-2023-21520 Information disclosure in AtHoc
- CVE-2025-12766 Information disclosure in BlackBerry® AtHoc® (OnPrem)
Sources
Also known as GHSA-r4vr-ph3f-83x7.