CVE-2023-7039

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-7039
A vulnerability classified as critical has been found in Byzoro S210 up to 20231210. Affected is an unknown function of the file /importexport.php. The manipulation of the argument sql leads to injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-248688.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.5 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
https://github.com/Stitch3612/cve/blob/main/rce.md Exploit Third Party Advisory
https://vuldb.com/?ctiid.248688 Permissions Required Third Party Advisory
https://vuldb.com/?id.248688 Permissions Required Third Party Advisory
https://vuldb.com/?submit.250043
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:byzoro:smart_s210_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:byzoro:smart_s210:-:*:*:*:*:*:*:*
History

09 Apr 2024, 09:15

Type Values Removed Values Added
References
  • () https://vuldb.com/?submit.250043 -
Summary (en) A vulnerability classified as critical has been found in Beijing Baichuo S210 up to 20231210. Affected is an unknown function of the file /importexport.php. The manipulation of the argument sql leads to injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-248688. (en) A vulnerability classified as critical has been found in Byzoro S210 up to 20231210. Affected is an unknown function of the file /importexport.php. The manipulation of the argument sql leads to injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-248688.

03 Jan 2024, 15:03

Type Values Removed Values Added
CPE cpe:2.3:o:byzoro:smart_s210_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:byzoro:smart_s210:-:*:*:*:*:*:*:*
First Time Byzoro smart S210 Firmware
Byzoro smart S210
Byzoro
References () https://github.com/Stitch3612/cve/blob/main/rce.md - () https://github.com/Stitch3612/cve/blob/main/rce.md - Exploit, Third Party Advisory
References () https://vuldb.com/?ctiid.248688 - () https://vuldb.com/?ctiid.248688 - Permissions Required, Third Party Advisory
References () https://vuldb.com/?id.248688 - () https://vuldb.com/?id.248688 - Permissions Required, Third Party Advisory
CWE NVD-CWE-noinfo
CVSS v2 : 6.5
v3 : 6.3 		v2 : 6.5
v3 : 9.8

22 Dec 2023, 12:18

Type Values Removed Values Added
Summary
  • (es) Una vulnerabilidad ha sido encontrada en Beijing Baichuo S210 hasta 20231210 y clasificada como crítica. Una función desconocida del archivo /importexport.php es afectada por esta vulnerabilidad. La manipulación del argumento sql conduce a la inyección. Es posible lanzar el ataque de forma remota. La explotación ha sido divulgada al público y puede utilizarse. El identificador de esta vulnerabilidad es VDB-248688.

21 Dec 2023, 19:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-12-21 19:15

Updated : 2024-04-11 01:23

NVD link : CVE-2023-7039

Mitre link : CVE-2023-7039

CVE.ORG link : CVE-2023-7039

JSON object : View

Products Affected

byzoro

  • smart_s210
  • smart_s210_firmware
CWE
NVD-CWE-noinfo CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')