CVE-2023-4849 MEDIUM

CVE-2023-4849: IBOS OA trash&op=del sql injection

Vendor Ibos

Product OA

Weakness CWE-89 · SQLi

Published September 9, 2023

Last update September 26, 2024

View on NVD All CVEs

CVSS base score

6.3/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

What the vulnerability does

01Description

A vulnerability, which was classified as critical, has been found in IBOS OA 4.5.5. Affected by this issue is some unknown functionality of the file ?r=file/dashboard/trash&op=del. The manipulation of the argument fids leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-239258 is the identifier assigned to this vulnerability.

Key dates

02Disclosure timeline

September 9, 2023 CVE published

September 26, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-4849 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/89.html

Related vulnerabilities

04Related CVE

CVE-2026-13752 Snowflake CLI SQL Injection Through Improper Neutralization of Parameters in Secret Creation and SPCS Service Log Commands CVE-2024-8868 code-projects Crud Operation System savedata.php sql injection CVE-2023-4848 SourceCodester Simple Book Catalog App delete_book.php sql injection CVE-2025-14646 code-projects Student File Management System delete_student.php sql injection CVE-2024-5104 Campcodes Complete Web-Based School Management System student_grade_wise.php sql injection