I Bos
Monthly
SQL injection (CWE-89) in Interuse i-Bos 3.0 lets unauthenticated remote attackers pass crafted input that is concatenated into SQL statements, potentially exposing database contents. The assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N, base 5.9) shows confidentiality as the primary impact, with attack complexity rated High because reliable exploitation depends on a condition not fully under the attacker's control - characteristic of blind/inferential SQL injection, back-end-specific behavior, or a particular application state rather than a single deterministic request. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the report originates from Israel's INCD advisory stream.
SQL injection (CWE-89) in Interuse i-Bos 3.0 lets unauthenticated remote attackers pass crafted input that is concatenated into SQL statements, potentially exposing database contents. The assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N, base 5.9) shows confidentiality as the primary impact, with attack complexity rated High because reliable exploitation depends on a condition not fully under the attacker's control - characteristic of blind/inferential SQL injection, back-end-specific behavior, or a particular application state rather than a single deterministic request. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the report originates from Israel's INCD advisory stream.