2023-10-17

EasyUse MailHunter Ultimate - SQL Injection

ZUSOART ID

ZA-2023-07

CVE ID

CVE-2023-34210

Vulnerability Type

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSS 4.0 Base

7.7

Description

SQL Injection in create customer group function of EasyUse MailHunter Ultimate 2023 and earlier allow remote authenticated users to execute arbitrary SQL commands via the ctl00$ContentPlaceHolder1$txtCustSQL parameter.

Vendor

EasyUse Digital Technology

Product