Configurator
CVE-2023-43986
CRITICAL
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
DM Concept configurator before v4.9.4 was discovered to contain a SQL injection vulnerability via the component ConfiguratorAttachment::getAttachmentByToken.
AnalysisAI
DM Concept configurator before v4.9.4 was discovered to contain a SQL injection vulnerability via the component ConfiguratorAttachment::getAttachmentByToken. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified as SQL Injection (CWE-89), which allows attackers to execute arbitrary SQL commands against the database. DM Concept configurator before v4.9.4 was discovered to contain a SQL injection vulnerability via the component ConfiguratorAttachment::getAttachmentByToken. Affected products include: Dmconcept Configurator.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Use parameterized queries/prepared statements. Never concatenate user input into SQL. Apply least-privilege database permissions.
More in Configurator
View allUnauthenticated path traversal in Oracle Configurator's Runtime UI (part of Oracle E-Business Suite 12.2.3-12.2.14) expo
Unspecified vulnerability in the Oracle Configurator component in Oracle Supply Chain Products Suite 12.0.6, 12.1, and 1
Vulnerability in the Oracle Configurator product of Oracle Supply Chain (component: UI Servlet). Rated high severity (CV
Vulnerability in the Oracle Configurator product of Oracle Supply Chain (component: UI Servlet). Rated high severity (CV
Vulnerability in the Oracle Configurator product of Oracle Supply Chain (component: UI Servlet). Rated high severity (CV
Vulnerability in the Oracle Configurator product of Oracle Supply Chain (component: UI Servlet). Rated high severity (CV
Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Core). Rated high severity (CVSS
Vulnerability in the Oracle Configurator component of Oracle Supply Chain Products Suite (subcomponent: Active Model Gen
Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Orders). Rated medium severity (
Configurator contains a vulnerability that allows attackers to unauthorized read access to a subset of Oracle Configurat
Vulnerability in the Oracle Configurator product of Oracle Supply Chain (component: Installation). Rated medium severity
Unspecified vulnerability in the Oracle Configurator component in Oracle Supply Chain Products Suite 11.5.10.2, 12.1, an
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today