Description

SQL injection vulnerability in the upgrade process for SQL Server in Liferay Portal 7.3.1 through 7.4.3.17, and Liferay DXP 7.3 before update 6, and 7.4 before update 18 allows attackers to execute arbitrary SQL commands via the name of a database table's primary key index. This vulnerability is only exploitable when chained with other attacks. To exploit this vulnerability, the attacker must modify the database and wait for the application to be upgraded.

Remediation

References

CVE-2023-33945

Related Vulnerabilities

phpMyFAQ Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2018-16650)

WordPress Plugin WordPress Custom Settings Cross-Site Scripting (1.0)

XWiki Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2023-29211)

phpMyFAQ Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2023-0787)

WordPress Plugin Mail Masta Multiple SQL Injection Vulnerabilities (1.0)

Severity

High

Classification

CVE-2023-33945 CWE-138 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities