CVE-2023-4103 Multiple vulnerabilities in IDM Sistemas QSige

High 8.8 Published 3 Oct 2023 Updated 19 Sep 2024

Authenticated attackers can exploit SQL injection in QSige statistics to disclose information or cause denial of service.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-4103?

CVE-2023-4103 is a high-severity SQL injection vulnerability in IDM Sistemas QSige QSige, published on 3 Oct 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

QSige statistics are affected by a remote SQLi vulnerability. It has been identified that the web application does not correctly filter input parameters, allowing SQL injections, DoS or information disclosure. As a prerequisite, it is necessary to log into the application.

Weakness: CWE-89

Which versions are affected by CVE-2023-4103?

It affects 1 product.

Products include Qsige Qsige.

How do I fix CVE-2023-4103?

No fix has been published for CVE-2023-4103 yet. Limit exposure of the affected software until one is available.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2023-4103 being exploited?

There is no known exploitation of CVE-2023-4103 in the wild and no public exploit code.

Sources

Also known as GHSA-xwr3-6hhp-5cch.